A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/cor
Affects Jenkins weekly up to and including 2.153 and LTS up to and including 2.138.3, through the Stapler web framework. Fixed in LTS 2.138.4 and weekly 2.154.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.138.4, 2.154
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Stapler web framework used by the Jenkins automation server is affected. An attacker could craft specific URLs to invoke methods on Java objects that were not meant to be callable that way, potentially allowing arbitrary code execution on the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
- org.jenkins-ci.main:jenkins-coreMaven
fixed in 2.138.4
- org.jenkins-ci.main:jenkins-coreMaven
From 2.140 · fixed in 2.154
References 4
access.redhat.com
securityfocus.com
packetstormsecurity.com
Questions about CVE-2018-1000861
What does this mean?
Stapler can be made to invoke methods that were never meant to be reachable through URLs. Crafted requests can then lead to code execution, invalidated sessions, or user objects created in memory.Source: jenkins.io
Am I affected, and how do I check?
Jenkins weekly releases up to and including 2.153 and Jenkins LTS releases up to and including 2.138.3 are affected. Check the Jenkins version shown in the web interface to compare it with these ranges.Source: jenkins.io
What should I do about it?
Upgrade the LTS line to 2.138.4 or later, or the weekly line to 2.154 or later.Source: jenkins.io
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-02-10, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data