Jenkins 2.138 Remote Command Execution

Jenkins is an open-source automation server that is free to use. It is a server-side application that runs in servlet containers like Apache Tomcat.In stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, a code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier that allows attackers to call some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

Mitigation / Precaution

In order to patch this vulnerability, please install the official patch Jenkins made available for supported, vulnerable instances.

Written by

Sooraj V Nair

Cyber Security Engineer

Sooraj was probably the kid who opened up a remote control just to see what was inside, then had to figure out how to put it back together before anyone noticed. That curiosity eventually found its way into cybersecurity, where breaking things is actually part of the job description. Today, he explores vulnerabilities, analysis threats, and helps build safer digital spaces. His favourite question remains the same: “What happens if I try this?”