Hackers exploit Jenkins flaw CVE-2018
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-1000861 | Unauthenticated RCE in Jenkins Stapler Web Framework via Crafted URLs CVE-2018-1000861 is a critical flaw (CVSS 3.1: 9.8) in the Stapler web framework used by Jenkins, located in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, where crafted URLs cause the framework to invoke Java object methods that were never intended to be reachable over HTTP (CWE-502, deserialization of untrusted data). By chaining these unintended method invocations, an unauthenticated remote attacker can achieve code execution on the affected Jenkins instance. All Jenkins releases up to and including 2.153 (weekly line) and 2.138.3 (LTS line) are affected, and Red Hat OpenShift Container Platform deployments that ship bundled Jenkins/Stapler components are also in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 98.3% probability of exploitation within 30 days, and related reporting documents hackers exploiting this Jenkins flaw, with coverage of the WatchBog cryptomining botnet known to target it. No public proof-of-concept exploit is catalogued and ransomware use is unknown, but the KEV listing alone confirms real-world exploitation. Do: Upgrade Jenkins to a release newer than 2.153 (weekly) or newer than 2.138.3 (LTS), per vendor instructions (fixed releases are 2.154 / 2.138.4 or later), and apply Red Hat updates for OpenShift Container Platform images that bundle Jenkins. Until patched, keep Jenkins controllers off the open internet, restrict unauthenticated/anonymous access to the Jenkins UI, and review controller logs for crafted URLs that invoke unintended methods on Java objects. Because the flaw is in CISA KEV with a 98.3% EPSS score, treat patching as urgent and check internet-exposed controllers for signs of compromise such as cryptomining activity. | 9.8 | 98% | KEV |
| mass≈100,000+ internet-exposed Jenkins instances; total Jenkins deployments likely >1M |
Full article494 words · extracted from securityaffairs.com · click to collapse
Threat actors are exploiting a Jenkins vulnerability (CVE-2018-1000861) disclosed in 2018 to deliver a cryptocurrency miner using the Kerberods dropper.
SANS expert Renato Marinho uncovered an ongoing malicious campaign that is targeting vulnerable Apache Jenkins installs to deliver a Monero cryptominer dubbed Kerberods.
According to the SANS Institute’s Internet Storm Center, attackers are exploiting the CVE-2018-1000861 vulnerability in the Stapler HTTP request handling engine used by Jenkins servers.
Jenkins is the most popular open source automation server, it is maintained by CloudBees and the Jenkins community. The automation server supports developers build, test and deploy their applications, it has hundreds of thousands of active installations worldwide with more than 1 million users.
The vulnerability was addressed in December 2018 by the Jenkins development team that warned of the following potential attacks:
- Unauthenticated users can invalidate all sessions when running Jenkins with the built-in Winstone-Jetty server.
- Users with Overall/Read permission could create new user objects in memory.
- Users with Overall/Read access could manually kick off otherwise periodically executed runs of implementations of AsyncPeriodicWork.
Security researchers publicly disclosed technical details of the vulnerability. The flaw could be chained with other issued to get remote code execution.
According to SANS handler Renato Marinho, a proof-of-concept (PoC) exploit for CVE-2018-1000861 was released in early March.
Marinho noticed some attacks hit one of his honeypots attempting to exploit this Jenkins vulnerability to deliver the Kerberods cryptominer.
“Looking for publicly available exploits for this vulnerability, I could find a detailed proof of concept published early March this year.” reads the analysis published by Marinho.
“After analyzing the threat which attacked one of my honeypots, I created the diagram shown in the picture below. Follow the numbers in blue to understand each step.”
The Kerberods dropper is packed with a custom version of the UPX packer, it attempts to obtain root privileges to hide its presence and gain persistence.
“After analyzing the binary, I could see that the packer used was a custom version of ‘UPX’. UPX is an open source software and there are many ways UPX can be modified to make it hard to unpack the file using regular UPX version.” continues the analysis. “Fortunately, in this case, the UPX customizations involved just the modification of the magic constant UPX_MAGIC_LE32 from ‘UPX’ to some other three letters. Thus, reverting it to UPX in different parts of the binary, it was possible to unpack the binary with the regular version of UPX. “
Once obtained the root permissions, Kerberods will load a library into the operating system that hooks different functions of Glibc, acting like a rootkit.
In the absence of root permissions, the malware created a cron job to ensure persistence.
Kerberods downloads and executes a Monero cryptocurrency miner on the infected system, it also uses local SSH keys for lateral movements. The malware also search for other vulnerable Jenkins servers on the internet.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Jenkins, Miner)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/85215/malware/jenkins-vulnerability-attacks-kerberods.html