Jenkins 2.138 Remote Command Execution

By
Sooraj V Nair
Published on
16 Jun 2021
Vulnerability

Jenkins is an open-source automation server that is free to use. It is a server-side application that runs in servlet containers like Apache Tomcat.In stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, a code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier that allows attackers to call some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Mitigation / Precaution

In order to patch this vulnerability, please install the official patch Jenkins made available for supported, vulnerable instances.

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Sooraj V Nair
Sooraj V Nair
Cyber Security Engineer
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 10 days
Find surface-level website security issues in under a minute
Free website security assessment
Experience the power of automated penetration testing & contextual reporting.