Improper input validation in Jenkins - CVE-2018-1000861
Published: December 18, 2018 / Updated: September 13, 2023
Vulnerability identifier: #VU16575
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1000861
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.
The vulnerability exists due to due to improper handling of HTTP requests by the stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java code of the Stapler web framework used by the affected software. A remote attacker can trick the victim into accessing a specially crafted link that submits malicious input, invoke certain methods that are not intended to be invoked, which the attacker can use to execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Jenkins
How to mitigate CVE-2018-1000861
The vulnerability has been fixed in the versions 2.154, 2.138.4, and 2.150.1.
Jenkins - addressed in versions 2.138.4, 2.150.1, 2.154
Links to Public Exploits and PoC-codes
- Exploit #9317 - CVE-2018-1000861 (CVE-2018-1000861 Exploit) (September 13, 2023)
- Exploit #2345 - cve-2019-1003000-jenkins-rce-poc (Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)) (April 7, 2020)
- Exploit #1552 - Jenkins ACL Bypass and Metaprogramming RCE (March 18, 2020)