Jenkins - RCE (CVE-2018-1000861)
Description
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
psychologyCrowdSec Analysis
CVE-2018-1000861 is a remote code execution vulnerability in the Stapler web framework, used by Jenkins 2.153 and earlier and LTS 2.138.3 and earlier. It allows attackers to invoke unintended Java object methods via specially crafted URLs. Exploiting this flaw could enable threat actors to execute arbitrary code on the server, potentially leading to full system compromise and further attacks on Jenkins environments.
CrowdSec has been tracking this vulnerability and its exploits since 17th of January 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2018-1000861 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit Jenkins by sending crafted requests to the checkScriptCompile endpoint with malicious Groovy code in the value parameter, enabling remote code execution via the Stapler web framework.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2018-12-10 |
| CISA KEV | 2022-02-10 |
| CISA Remediation Deadline | 2022-08-10 |
| Rule Released | 2024-01-17 |
| CrowdSec First Seen | 2026-08-11 |