CVE-2018-1000861

CVE-2018-1000861 is a critical flaw (CVSS 3.1: 9.8) in the Stapler web framework used by Jenkins, located in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, where crafted URLs cause the framework to invoke Java object methods that were never intended to be reachable over HTTP (CWE-502, deserialization of untrusted data). By chaining these unintended method invocations, an unauthenticated remote attacker can achieve code execution on the affected Jenkins instance. All Jenkins releases up to and including 2.153 (weekly line) and 2.138.3 (LTS line) are affected, and Red Hat OpenShift Container Platform deployments that ship bundled Jenkins/Stapler components are also in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 98.3% probability of exploitation within 30 days, and related reporting documents hackers exploiting this Jenkins flaw, with coverage of the WatchBog cryptomining botnet known to target it. No public proof-of-concept exploit is catalogued and ransomware use is unknown, but the KEV listing alone confirms real-world exploitation.

What to do: Upgrade Jenkins to a release newer than 2.153 (weekly) or newer than 2.138.3 (LTS), per vendor instructions (fixed releases are 2.154 / 2.138.4 or later), and apply Red Hat updates for OpenShift Container Platform images that bundle Jenkins. Until patched, keep Jenkins controllers off the open internet, restrict unauthenticated/anonymous access to the Jenkins UI, and review controller logs for crafted URLs that invoke unintended methods on Java objects. Because the flaw is in CISA KEV with a 98.3% EPSS score, treat patching as urgent and check internet-exposed controllers for signs of compromise such as cryptomining activity.