.. / CVE-2018-1000861

• RCE
• Nuclei
• Web

Exploit for Jenkins - Remote Command Injection (CVE-2018-1000861)

Description:

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Nuclei Template

View the template here CVE-2018-1000861.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-1000861.yaml

References: