CVE-2018-1000861

What is Jenkins?

Jenkins is the most widely deployed open-source automation server, used by organizations of every size to run continuous integration and continuous delivery (CI/CD) pipelines. Because Jenkins instances typically hold source-code access, build credentials, deployment keys, and cloud service tokens needed to ship software, a Jenkins compromise frequently gives an attacker a direct path into an organization's software supply chain, not just the Jenkins host itself.

Overview

CVE-2018-1000861 is a critical, unauthenticated remote code execution vulnerability in Stapler, the web application framework Jenkins uses to map URLs to Java objects and methods. An attacker can send a specially crafted HTTP request that reaches unintended, non-whitelisted Java methods through Stapler's URL-routing and dispatch logic, and by chaining this access with other classes available on the Jenkins classpath, achieve full remote code execution without any authentication.

Technical Details

The root cause is classified under CWE-502 (deserialization/handling of untrusted data): Stapler's dynamic dispatch mechanism resolves URL path segments to Java method calls in a way that did not sufficiently restrict which internal methods and classes were reachable from an external HTTP request. Attackers could craft a URL that Stapler would resolve to a method chain ending in the invocation of an unsafe method — a class of "method dispatch" or "signature-based access control" bypass that, combined with gadget classes present in Jenkins' own dependencies, provided a full pre-authentication RCE primitive. No credentials, session, or user interaction are required — a single crafted HTTP request suffices.

Discovery

The vulnerability was identified and reported by security researchers on Semmle's security research team, and fixed by the Jenkins project in its December 2018 security advisory, alongside several related Jenkins core and Stapler-framework fixes.

Exploitation Context

CVE-2018-1000861 has been exploited very widely since disclosure. It became a favorite of cryptomining botnet operators scanning the internet for exposed Jenkins instances, given Jenkins servers' typically high compute allocation for build workloads. It has also been cited in CISA/FBI advisories on state-sponsored threat activity — including joint advisories on North Korean-linked actors exploiting known vulnerabilities in internet-facing applications — as one of several older, unpatched CVEs used to gain initial access to target networks. Its addition to the KEV catalog in 2022 reflects this sustained pattern of real-world abuse against unpatched Jenkins deployments years after the original fix shipped.

Remediation

1. Upgrade Jenkins to version 2.153 or later (or LTS 2.150.2 or later), which include the Stapler framework fix.
2. Never expose the Jenkins web interface directly to the internet without authentication and network-level access controls in front of it.
3. Apply the principle of least privilege to Jenkins credentials and cloud/deployment tokens stored in the instance, limiting blast radius if the platform is compromised despite patching.
4. Monitor Jenkins server resource usage and process activity for signs of cryptomining or unauthorized job execution.
5. Review Jenkins job configurations, credentials store, and plugin inventory for unauthorized changes if the instance was ever exposed prior to patching.