{"vulnerability": "CVE-2020-36239", "sightings": [{"uuid": "2d481f7b-e814-4729-9326-6bb349668a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "MISP/3379a8e9-a13c-42af-8a21-b1907a3be73e", "content": "", "creation_timestamp": "2024-11-14T06:09:24.000000Z"}, {"uuid": "6b7dbc4c-bd30-4d9b-a4fa-f226ff1426c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/cKure/6261", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 Multiple versions of its Jira Data Center and Jira Service Management Data Center product has\u00a0CVE-2020-36239; that can give remote attackers code execution abilities, due to\u00a0a missing authentication flaw in Ehcache RMI.\n\nhttps://www.bleepingcomputer.com/news/security/atlassian-asks-customers-to-patch-critical-jira-vulnerability/", "creation_timestamp": "2021-07-22T08:36:14.000000Z"}, {"uuid": "880c0e40-3e9d-41ce-978b-33b43a27c1f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/BleepingComputer/10187", "content": "Atlassian asks customers to patch critical Jira vulnerability\n\nAtlassian is prompting\u00a0its enterprise customers to patch a critical vulnerability in multiple versions of its Jira Data Center and Jira Service Management Data Center products. The vulnerability tracked as\u00a0CVE-2020-36239 can give remote attackers code execution abilities, due to\u00a0a missing authentication flaw in Ehcache RMI. [...]\n\nhttps://www.bleepingcomputer.com/news/security/atlassian-asks-customers-to-patch-critical-jira-vulnerability/", "creation_timestamp": "2021-07-22T18:24:23.000000Z"}, {"uuid": "af21c47b-15e7-43fb-9009-c7a20b308881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "published-proof-of-concept", "source": "https://t.me/ETHICALHACKERSCOMMUNITY2/349", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935", "creation_timestamp": "2022-05-12T22:17:01.000000Z"}, {"uuid": "9bd4ccd5-d89c-4c74-b459-f0c74fba5d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/cibsecurity/26565", "content": "\u203c CVE-2020-36239 \u203c\n\nJira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17.0 exposed a Ehcache RMI network service which attackers, who can connect to the service, on port 40001 and potentially 40011[0][1], could execute arbitrary code of their choice in Jira through deserialization due to a missing authentication vulnerability. While Atlassian strongly suggests restricting access to the Ehcache ports to only Data Center instances, fixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service. [0] In Jira Data Center, Jira Core Data Center, and Jira Software Data Center versions prior to 7.13.1, the Ehcache object port can be randomly allocated. [1] In Jira Service Management Data Center versions prior to 3.16.1, the Ehcache object port can be randomly allocated.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-29T14:14:13.000000Z"}, {"uuid": "c9819544-c932-478a-97a8-0fec0d442746", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3988", "content": "#Offensive_security\n1. Developing an exploit for the Jira Data Center Ehcache RCE (CVE-2020-36239)\nhttps://dozer.nz/posts/CVE-2020-36239-POC-dev\n2. Playing with PuTTY\nhttps://labs.f-secure.com/blog/playing-with-putty", "creation_timestamp": "2021-08-04T11:28:13.000000Z"}, {"uuid": "0437276f-f765-4eef-b914-d7f6d7612df5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/cissp/3967", "content": "Red Team Tactics\n1. PostMessage XSS Attack\nhttps://medium.com/@youghourtaghannei/postmessage-xss-vulnerability-on-private-program-18e773e1a1ba\n2. Bypassing Authentication on Arcadyan Routers with CVE-2021-20090 and rooting some Buffalo\nhttps://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2\n\nOffensive security\n1. Developing an exploit for the Jira Data Center Ehcache RCE (CVE-2020-36239)\nhttps://dozer.nz/posts/CVE-2020-36239-POC-dev\n2. Playing with PuTTY\nhttps://labs.f-secure.com/blog/playing-with-putty\n\nThreat Research\n1. Windows Command-Line Obfuscation\nhttps://www.wietzebeukema.nl/blog/windows-command-line-obfuscation?fbclid=IwAR0lQRf9T5BTvCyXxdNP_WLH5oDR-CJe7eO-LUVf_kPWlVaxQZaKgQc3Jvw\n2. Escaping from a truly air gapped network via Apple AWDL\nhttps://medium.com/sensorfu/escaping-from-a-truly-air-gapped-network-via-apple-awdl-6cf6f9ea3499", "creation_timestamp": "2026-09-01T17:00:44.068089Z"}, {"uuid": "e431aa73-7ce9-4052-8395-9296deca9c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.534599Z"}, {"uuid": "a6821fe5-15b5-44cc-92ac-1544807d56a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:40.974201Z"}, {"uuid": "d16df978-8aa8-4727-8617-761a7d358269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/17478", "content": "Black Hat Ethical Hacking\nCritical Jira Flaw in Atlassian Could Lead to RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Critical Jira Flaw in Atlassian Could Lead to RCEPost Views: 96 \nReading Time: 2 Minutes\nAtlassian has dropped a patch for a critical vulnerability in many versions of its Jira Data Center and Jira Service Management Data Center products, which can lead to arbitrary code execution.\nAtlassian is a platform that\u2019s used by 180,000 customers to engineer software and manage projects, and Jira is its proprietary bug-tracking and agile project-management tool.\n\nOn Wednesday, Atlassian issued a security advisory concerning the vulnerability, which is tracked as CVE-2020-36239. The bug could enable remote, unauthenticated attackers to execute arbitrary code in some Jira Data Center products. BleepingComputer\u00a0got ahold of an email Atlassian sent to enterprise customers on Wednesday that urged them to update ASAP.\n\nThe vulnerability has to do with a missing authentication check in Jira\u2019s implementation of Ehcache, which is an open-source, Java distributed cache for general-purpose caching, Java EE and lightweight containers that\u2019s used for performance and which simplifies scalability.\n\nAtlassian said that the bug was introduced in version 6.3.0 of Jira Data Center, Jira Core Data Center, Jira Software Data Center and Jira Service Management Data Center (known as Jira Service Desk prior to 4.14).\n\nAccording to Atlassian\u2019s security advisory, that list of products exposed a Ehcache remote method invocation (RMI) network service that attackers \u2013 who can connect to the service on port 40001 and potentially 40011 \u2013 could use to \u201cexecute arbitrary code of their choice in Jira\u201d through deserialization, due to missing authentication.\n\nRMI is an API that acts as a mechanism to enable remote communication between programs written in Java. It allows an object residing in one Java virtual machine (JVM) to invoke an object running on another JVM; Often, it involves one program on a server and one on a client. The advantage of RMI, as BleepingComputer describes it, is that \u201cprogrammers can invoke methods present in remote objects\u2014such as those present within an application running on a shared network, right from their application as they would run a local method or procedure.\u201d https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/22161351/RMI.png Workings of RMI. Source: Wikipedia.\nSee Also: Microsoft: New Unpatched Bug in Windows Print Spooler\nAtlassian \u201cstrongly suggests\u201d restricting access to the Ehcache ports to only Data Center instances, but noted that there\u2019s a caveat: \u201cFixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service,\u201d according to the advisory. Affected VersionsThese are the affected versions of Jira Data Center and Jira Service Management Data Center: Jira Data Center, Jira Core Data Center, and Jira Software Data Center \u2013 ranges* 6.3.0 <=\n* 8.6.0 <=\n* 8.14.0 <= Jira Service Management Data Center \u2013 ranges* 2.0.2 <=\n* 4.6.0 <=\n* 4.14.0 <= Jira Data Center, Jira Core Data Center, and Jira Software Data Center* All 6.3.x, 6.4.x versions\n* All 7.0.x, 7.1.x , 7.2.x, 7.3.x, 7.4.x, 7.5.x, 7.6.x, 7.7.x, 7.8.x, 7.9.x, 7.10.x, 7.11.x, 7.12.x, 7.13.x versions\n* All 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x versions\n* All 8.5.x versions before 8.5.16\n* All 8.6.x, 8.7.x, 8.8.x, 8.9.x, 8.10.x, 8.11.x, 8.12.x versions\n* All 8.13.x versions before 8.13.8\n* All 8.14.x, 8.15.x, 8.16.x versions Jira Service Management Data Center* All 2.x.x versions after 2.0.2\n* All 3.x.x versions\n* All 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x ve[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.703520Z"}, {"uuid": "d8016e9a-abd7-43b0-a04d-498c55d15b25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/17479", "content": "rsions\n* All 4.5.x versions before 4.5.16\n* All 4.6.x, 4.7.x, 4.8.x, 4.9.x, 4.10.x, 4.11.x, 4.12.x versions\n* All 4.13.x versions before 4.13.8\n* All 4.14.x, 4.15.x, 4.16.x versions\n\nAtlassian\u2019s advisory said that customers who have downloaded and installed any affected versions \u201cmust upgrade their installations immediately to fix this vulnerability.\u201d Having said that, Atlassian also noted that the \u201ccritical\u201d rating is its own assessment and that customers \u201cshould evaluate its applicability to your own IT environment.\u201d Non-Affected VersionsHere\u2019s the list of products that aren\u2019t affected by the flaw:\n\n* Atlassian Cloud\n* Jira Cloud\n* Jira Service Management Cloud\n* Non-Data Center instances of Jira Server (Core & Software) and Jira Service Management\n\nAlso, customers who have upgraded Jira Data Center, Jira Core Data Center, Jira Software Data Center to versions 8.5.16, 8.13.8, 8.17.0 and/or Jira Service Management Data Center to versions 4.5.16, 4.13.8 or 4.17.0 are off the hook: They don\u2019t need to upgrade.\n\nAtlassian \u201cstrongly suggests\u201d restricting access to the Ehcache ports to only Data Center instances, but noted that there\u2019s a caveat: \u201cFixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service,\u201d according to the advisory. See Also: Offensive Security Tool: Veil Atlassian is Attacker CatnipSome of the largest enterprises with the most sophisticated product development use Atlassian products. Among its more than 65,000 users, Jira counts some big fans, including the likes of the Apache Software Foundation, Cisco, Fedora Commons, Hibernate, Pfizer and Visa.\n\nUnfortunately, its popularity \u2013 particularly with the big fish \u2013 and its capabilities make it a tempting target for attackers.\n\nIn June, researchers uncovered Atlassian bugs\u00a0that could have led to one-click takeover: A scenario that brought to mind the potential for an exploit that would have been similar to the SolarWinds\u00a0supply-chain attack, in which attackers used a default password as an open door into a software-updating mechanism.\n\nChris Morgan, senior cyber-threat intelligence analyst at digital-risk provider Digital Shadows, said that the vulnerability at the heart of Wednesday\u2019s advisory is just the latest in a series of bugs facing software engineering and management platforms that, if exploited, \u201ccould lead to a range of pernicious outcomes.\u201d\n\nWhile there\u2019s no evidence of active exploitation at this time, we can expect attempts to show up in the coming one to three months, Morgan predicted. \u201cCVE-2020-36239 can be remotely exploited to achieve arbitrary code execution and will likely be of great interest to both cybercriminals and nation-state-associated actors,\u201d he said. He pointed to several recent supply-chain attacks, including attacks against software providers Accellion\u00a0and Kaseya, that have leveraged vulnerabilities to gain initial access and to compromise software builds \u201cknown to be used by a diverse client base.\u201d\n\nOther security experts agreed with Morgan\u2019s assessment. Andrew Barratt, managing principal of solutions and investigations at cybersecurity advisory firm Coalfire, told Threatpost on Thursday that the vulnerability Atlassian disclosed on Wednesday \u201cshows that attackers are still looking to leverage economies of scale and compromise multiple parties using single platform-wide vulnerabilities.\u201d Expect Exploitation, In the Wild AttacksTL;DR: Apply the update ASAP, or implement Atlassian\u2019s workarounds, Morgan emphasized.\n\nThat said, the real impact depends on the exposure of the RMI APIs, Barratt suggested. \u201cThis could lead to targeted campaigns that focus on developers (historically who have lots of privileges and useful tools on their machines) that then seek to drop malware that exploits the Atlassian vulnerabilities for further manipulation of product development,\u201d he said.\n\nOn the optimistic side, the issue may blow[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:30.751173Z"}, {"uuid": "23668bee-49e8-463c-84fd-7f2d2c04181f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/53231", "content": "Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple    keywords (e.g. cmd.exe)  gadget chains (e.g. CommonsCollection)  object types (e.g. ViewState, Java, Python Pickle, PHP)  encodings (e.g. Base64, raw)  rule types (e.g. Snort, Yara)  \n  Disclaimer  Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.  Please test thoroughly before deploying to any production systems.  The Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.)  Usage  Help:  python3 heyserial.py -h  Examples:  python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\"    Utils  utils/checkyoself.py  This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.  Usage:  python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap  Examples:  python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses  utils/generate_payloads.ps1  YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.    Source: https://github.com/pwntester/ysoserial.net  License: ysoserial.net_LICENSE.txt    utils/generate_payloads.sh  YSoSerial payload generation. Run on Linux from the ./utils directory.    Source: https://github.com/frohoff/ysoserial  License: ysoserial_LICENSE.txt    utils/install_snort.sh  Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.  Use at your own risk in a VM that you have snapshotted recently.  utils/server.py  Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.  Handy for generating test PCAPs.  License  Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License.  Contributing  Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial!  Prior Work/Related Resources  Tools    Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) \u2013 @GrrrDog  Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff  MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff  Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g  Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester  ViewGen (https://github.com/0xacb/viewgen) \u2013 0xacb  Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research    Vulnerabilities    Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/))  Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321))  Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189))  Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/))  Telerik (CVE-2019-18935\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:50.675718Z"}, {"uuid": "f8cb0596-83f0-41d7-8383-cb1dc3141830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/53237", "content": "KitPloit - PenTest Tools!\nHeyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh96iyLi-WJuKHxzsUe2ew0LLbVkwXkKoWXWpcZ0mRX6YUdBo7uzVq0lxIihLA9awRncMpRG3Pz54Becx4VdqrQLs5gSE0N0eXTFeY3SvASRKmLUj29WSoNXUB9oiczpcdLkgyqQmTBmYpjyy432kXPM87zwjhA7s0hfpa0u5aqBPpNFNzCyggYVI4E/w640-h370/deserialization1.png Programmatically create hunting rules for deserialization exploitation with multiple\n\n* keywords (e.g. cmd.exe)\n* gadget chains (e.g. CommonsCollection)\n* object types (e.g. ViewState, Java, Python Pickle, PHP)\n* encodings (e.g. Base64, raw)\n* rule types (e.g. Snort, Yara) DisclaimerRules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.\n\nPlease test thoroughly before deploying to any production systems.\n\nThe Yara rules are primarily intended for scanning web server logs. Some of the \"object prefixes\" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) UsageHelp: python3 heyserial.py -hExamples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj  python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode'  python3 heyserial.py -k Process.Start -t NETViewState -e base64 \"base64+utf16le\" Utilsutils/checkyoself.pyThis is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.\n\nUsage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcapExamples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_missesutils/generate_payloads.ps1YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.\n\n* Source: https://github.com/pwntester/ysoserial.net\n* License: ysoserial.net_LICENSE.txt utils/generate_payloads.shYSoSerial payload generation. Run on Linux from the ./utils directory.\n\n* Source: https://github.com/frohoff/ysoserial\n* License: ysoserial_LICENSE.txt utils/install_snort.shInstalling Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.\n\nUse at your own risk in a VM that you have snapshotted recently. utils/server.pySimple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.\n\nHandy for generating test PCAPs. LicenseCopyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved.  Licensed under the Apache License, Version 2.0 (the \"License\"); you may not use this file except in compliance with the License.  You may obtain a copy of the License at: [package root]/LICENSE.txt  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and limitations under the License. ContributingCheck out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related ResourcesTools\n\n* Deserialization-Cheat-Sheet \u2013 @GrrrDog\n* Ysoserial - @frohoff\n* MarshalSec - @frohoff\n* Ysoserial (forked) - @wh1t3p1g\n* Ysoserial.NET and v2 branch - @pwntester\n* ViewGen \u2013 0xacb\n* Rogue-JNDI - @veracode-research\n\nVulnerabilities\n\n* Log4J (CVE-2021-44228)\n* Exchange (CVE-2021-42321)\n* Zoho ManageEngine (CVE-2020-10189)\n* Jira (CVE-2020-36239)\n* Telerik (CVE-2019-18935)\n* C1 CMS (CVE-2019-18211)\n* Jenkins (CVE-2016-9299)\n* What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnera[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:49.939096Z"}, {"uuid": "b9742c47-8aec-4204-9735-2b02a162f7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/17478", "content": "Black Hat Ethical Hacking\nCritical Jira Flaw in Atlassian Could Lead to RCE\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Critical Jira Flaw in Atlassian Could Lead to RCEPost Views: 96 \nReading Time: 2 Minutes\nAtlassian has dropped a patch for a critical vulnerability in many versions of its Jira Data Center and Jira Service Management Data Center products, which can lead to arbitrary code execution.\nAtlassian is a platform that\u2019s used by 180,000 customers to engineer software and manage projects, and Jira is its proprietary bug-tracking and agile project-management tool.\n\nOn Wednesday, Atlassian issued a security advisory concerning the vulnerability, which is tracked as CVE-2020-36239. The bug could enable remote, unauthenticated attackers to execute arbitrary code in some Jira Data Center products. BleepingComputer\u00a0got ahold of an email Atlassian sent to enterprise customers on Wednesday that urged them to update ASAP.\n\nThe vulnerability has to do with a missing authentication check in Jira\u2019s implementation of Ehcache, which is an open-source, Java distributed cache for general-purpose caching, Java EE and lightweight containers that\u2019s used for performance and which simplifies scalability.\n\nAtlassian said that the bug was introduced in version 6.3.0 of Jira Data Center, Jira Core Data Center, Jira Software Data Center and Jira Service Management Data Center (known as Jira Service Desk prior to 4.14).\n\nAccording to Atlassian\u2019s security advisory, that list of products exposed a Ehcache remote method invocation (RMI) network service that attackers \u2013 who can connect to the service on port 40001 and potentially 40011 \u2013 could use to \u201cexecute arbitrary code of their choice in Jira\u201d through deserialization, due to missing authentication.\n\nRMI is an API that acts as a mechanism to enable remote communication between programs written in Java. It allows an object residing in one Java virtual machine (JVM) to invoke an object running on another JVM; Often, it involves one program on a server and one on a client. The advantage of RMI, as BleepingComputer describes it, is that \u201cprogrammers can invoke methods present in remote objects\u2014such as those present within an application running on a shared network, right from their application as they would run a local method or procedure.\u201d https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/22161351/RMI.png Workings of RMI. Source: Wikipedia.\nSee Also: Microsoft: New Unpatched Bug in Windows Print Spooler\nAtlassian \u201cstrongly suggests\u201d restricting access to the Ehcache ports to only Data Center instances, but noted that there\u2019s a caveat: \u201cFixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service,\u201d according to the advisory. Affected VersionsThese are the affected versions of Jira Data Center and Jira Service Management Data Center: Jira Data Center, Jira Core Data Center, and Jira Software Data Center \u2013 ranges* 6.3.0 <=\n* 8.6.0 <=\n* 8.14.0 <= Jira Service Management Data Center \u2013 ranges* 2.0.2 <=\n* 4.6.0 <=\n* 4.14.0 <= Jira Data Center, Jira Core Data Center, and Jira Software Data Center* All 6.3.x, 6.4.x versions\n* All 7.0.x, 7.1.x , 7.2.x, 7.3.x, 7.4.x, 7.5.x, 7.6.x, 7.7.x, 7.8.x, 7.9.x, 7.10.x, 7.11.x, 7.12.x, 7.13.x versions\n* All 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x versions\n* All 8.5.x versions before 8.5.16\n* All 8.6.x, 8.7.x, 8.8.x, 8.9.x, 8.10.x, 8.11.x, 8.12.x versions\n* All 8.13.x versions before 8.13.8\n* All 8.14.x, 8.15.x, 8.16.x versions Jira Service Management Data Center* All 2.x.x versions after 2.0.2\n* All 3.x.x versions\n* All 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x ve[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.415884Z"}, {"uuid": "9d4538a3-4c6c-4ea0-9bf3-aa7488c30ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/hacking_Attack/17479", "content": "rsions\n* All 4.5.x versions before 4.5.16\n* All 4.6.x, 4.7.x, 4.8.x, 4.9.x, 4.10.x, 4.11.x, 4.12.x versions\n* All 4.13.x versions before 4.13.8\n* All 4.14.x, 4.15.x, 4.16.x versions\n\nAtlassian\u2019s advisory said that customers who have downloaded and installed any affected versions \u201cmust upgrade their installations immediately to fix this vulnerability.\u201d Having said that, Atlassian also noted that the \u201ccritical\u201d rating is its own assessment and that customers \u201cshould evaluate its applicability to your own IT environment.\u201d Non-Affected VersionsHere\u2019s the list of products that aren\u2019t affected by the flaw:\n\n* Atlassian Cloud\n* Jira Cloud\n* Jira Service Management Cloud\n* Non-Data Center instances of Jira Server (Core & Software) and Jira Service Management\n\nAlso, customers who have upgraded Jira Data Center, Jira Core Data Center, Jira Software Data Center to versions 8.5.16, 8.13.8, 8.17.0 and/or Jira Service Management Data Center to versions 4.5.16, 4.13.8 or 4.17.0 are off the hook: They don\u2019t need to upgrade.\n\nAtlassian \u201cstrongly suggests\u201d restricting access to the Ehcache ports to only Data Center instances, but noted that there\u2019s a caveat: \u201cFixed versions of Jira will now require a shared secret in order to allow access to the Ehcache service,\u201d according to the advisory. See Also: Offensive Security Tool: Veil Atlassian is Attacker CatnipSome of the largest enterprises with the most sophisticated product development use Atlassian products. Among its more than 65,000 users, Jira counts some big fans, including the likes of the Apache Software Foundation, Cisco, Fedora Commons, Hibernate, Pfizer and Visa.\n\nUnfortunately, its popularity \u2013 particularly with the big fish \u2013 and its capabilities make it a tempting target for attackers.\n\nIn June, researchers uncovered Atlassian bugs\u00a0that could have led to one-click takeover: A scenario that brought to mind the potential for an exploit that would have been similar to the SolarWinds\u00a0supply-chain attack, in which attackers used a default password as an open door into a software-updating mechanism.\n\nChris Morgan, senior cyber-threat intelligence analyst at digital-risk provider Digital Shadows, said that the vulnerability at the heart of Wednesday\u2019s advisory is just the latest in a series of bugs facing software engineering and management platforms that, if exploited, \u201ccould lead to a range of pernicious outcomes.\u201d\n\nWhile there\u2019s no evidence of active exploitation at this time, we can expect attempts to show up in the coming one to three months, Morgan predicted. \u201cCVE-2020-36239 can be remotely exploited to achieve arbitrary code execution and will likely be of great interest to both cybercriminals and nation-state-associated actors,\u201d he said. He pointed to several recent supply-chain attacks, including attacks against software providers Accellion\u00a0and Kaseya, that have leveraged vulnerabilities to gain initial access and to compromise software builds \u201cknown to be used by a diverse client base.\u201d\n\nOther security experts agreed with Morgan\u2019s assessment. Andrew Barratt, managing principal of solutions and investigations at cybersecurity advisory firm Coalfire, told Threatpost on Thursday that the vulnerability Atlassian disclosed on Wednesday \u201cshows that attackers are still looking to leverage economies of scale and compromise multiple parties using single platform-wide vulnerabilities.\u201d Expect Exploitation, In the Wild AttacksTL;DR: Apply the update ASAP, or implement Atlassian\u2019s workarounds, Morgan emphasized.\n\nThat said, the real impact depends on the exposure of the RMI APIs, Barratt suggested. \u201cThis could lead to targeted campaigns that focus on developers (historically who have lots of privileges and useful tools on their machines) that then seek to drop malware that exploits the Atlassian vulnerabilities for further manipulation of product development,\u201d he said.\n\nOn the optimistic side, the issue may blow[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.459233Z"}, {"uuid": "c59e4901-af4a-4d20-ac80-c8deea0308a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36239", "type": "seen", "source": "https://t.me/cissp/3967", "content": "Red Team Tactics\n1. PostMessage XSS Attack\nhttps://medium.com/@youghourtaghannei/postmessage-xss-vulnerability-on-private-program-18e773e1a1ba\n2. Bypassing Authentication on Arcadyan Routers with CVE-2021-20090 and rooting some Buffalo\nhttps://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2\n\nOffensive security\n1. Developing an exploit for the Jira Data Center Ehcache RCE (CVE-2020-36239)\nhttps://dozer.nz/posts/CVE-2020-36239-POC-dev\n2. Playing with PuTTY\nhttps://labs.f-secure.com/blog/playing-with-putty\n\nThreat Research\n1. Windows Command-Line Obfuscation\nhttps://www.wietzebeukema.nl/blog/windows-command-line-obfuscation?fbclid=IwAR0lQRf9T5BTvCyXxdNP_WLH5oDR-CJe7eO-LUVf_kPWlVaxQZaKgQc3Jvw\n2. Escaping from a truly air gapped network via Apple AWDL\nhttps://medium.com/sensorfu/escaping-from-a-truly-air-gapped-network-via-apple-awdl-6cf6f9ea3499", "creation_timestamp": "2026-09-02T01:04:30.712113Z"}]}