What this checks: whether a Jenkins host runs a version affected by unauth CLI Java deserialization RCE. Read-only: it fingerprints Jenkins and reads the version, no exploitation.
3. Detection — reads the Jenkins version from the product's default response and version banner, compares to 2.57 (weekly) / 2.46.2 (LTS 2.46.x line). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Jenkins URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Jenkins and sorts each host by whether its version falls below the CVE-2017-1000353 fixed floors. CVE-2017-1000353 is unauthenticated remote code execution through Jenkins CLI remoting deserialization. This check never opens the CLI channel and never sends a serialized object. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /, fingerprints Jenkins from response markers and the X-Jenkins header, reads that version string, and compares it to the weekly and LTS floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when long-lived controllers still advertise old weekly builds. A controller frozen on 2.46.1 is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET / on each host and fingerprint Jenkins from response markers and the X-Jenkins header.
Parse the version from X-Jenkins and compare it to the CVE-2017-1000353 floors in the graph (2.57 and LTS 2.46.2).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Jenkins was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of / only. No CLI remoting handshake and no serialized payload.
Sample output
The records below are illustrative and do not come from a real run. They show one Jenkins host below a CVE-2017-1000353 floor, one at or above its floor, and one host that is not the product.