# CVE-2018-1000861: Jenkins - RCE

> Live exploitation tracking for CVE-2018-1000861 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-1000861

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Jenkins
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** cicd

## Description

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

## CrowdSec analysis

[CVE-2018-1000861](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000861) is a remote code execution vulnerability in the Stapler web framework, used by Jenkins 2.153 and earlier and LTS 2.138.3 and earlier. It allows attackers to invoke unintended Java object methods via specially crafted URLs. Exploiting this flaw could enable threat actors to execute arbitrary code on the server, potentially leading to full system compromise and further attacks on Jenkins environments.

CrowdSec has been tracking this vulnerability and its exploits since 17th of January 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2018-1000861 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit Jenkins by sending crafted requests to the `checkScriptCompile` endpoint with malicious Groovy code in the `value` parameter, enabling remote code execution via the Stapler web framework.

## Timeline

- 2018-12-10: CVE Published. CVE-2018-1000861 is published to NVD.
- 2022-02-10: CISA KEV. CVE-2018-1000861 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-08-10: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-01-17: Rule Released. CrowdSec releases a rule to detect CVE-2018-1000861 exploitation attempts against the CrowdSec Network.
- 2026-08-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2018-1000861 for the first time.

## References

- https://access.redhat.com/errata/RHBA-2019:0024
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000861.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-1000861) follows observed exploitation activity for CVE-2018-1000861. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.