PT-2018-3808 · Cloudbees+1 · Jenkins

Daniel Beck + 4 · Published 2018-12-05 · Updated 2025-11-05 · CVE-2018-1000861

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.153 and earlier Jenkins LTS versions 2.138.3 and earlier

Description A code execution issue exists in the Stapler web framework used by Jenkins, specifically in the MetaClass.java file, allowing attackers to invoke certain methods on Java objects by accessing crafted URLs. This is related to the deserialization of untrusted data, which can be exploited by a remote attacker to execute arbitrary code.

Recommendations For Jenkins versions 2.153 and earlier, update to a version that includes the fix for the deserialization vulnerability. For Jenkins LTS versions 2.138.3 and earlier, update to a version that includes the fix for the deserialization vulnerability. As a temporary workaround, consider restricting access to the MetaClass.java component in the Stapler web framework to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-04793

CVE-2018-1000861

GHSA-HHPM-5CP2-HG4X

Affected Products

Jenkins

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb · Exploit
• 🔥 https://github.com/orangetw/awesome-jenkins-rce-2019/blob/master/exp.py · Exploit
• 🔥 https://github.com/1NTheKut/CVE-2019-1003000_RCE-DETECTION · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000861 · Security Note
• https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04793 · Security Note
• https://access.redhat.com/errata/RHBA-2019:0024 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhpm-5cp2-hg4x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000861 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/47f38d714c99e1841fb737ad1005618eb26ed852 · Note
• http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/114823 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861 · Note
• http://securityfocus.com/bid/106176 · Note