What this checks: whether a Jenkins host runs a version affected by unauth Stapler method-invocation RCE. Read-only: it fingerprints Jenkins and reads the version, no exploitation.
3. Detection — reads the Jenkins version from the version exposed at /login, compares to 2.154 (weekly) / 2.138.4 or 2.150.1 (LTS). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Jenkins URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Jenkins and sorts each host by whether its version falls below the CVE-2018-1000861 fixed floors. CVE-2018-1000861 is a Stapler binding issue that can lead to remote code execution through unsafe deserialization. This check never invokes a Stapler route and never sends a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /login, fingerprints Jenkins from response markers and the X-Jenkins header, reads that version string, and compares it to the weekly and LTS floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when CI controllers lag on LTS bumps. A controller that stayed on 2.138.3 after the advisory is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /login on each host and fingerprint Jenkins from page markers and the X-Jenkins response header.
Parse the version from X-Jenkins and compare it to the CVE-2018-1000861 floors in the graph (2.154, LTS 2.138.4, LTS 2.150.1).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Jenkins was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /login only. No Stapler invoke and no deserialization payload.
Sample output
The records below are illustrative and do not come from a real run. They show one Jenkins host below a CVE-2018-1000861 floor, one at or above its floor, and one host that is not the product.
Builds below the floors in the graph: weekly 2.154, LTS 2.138.4, and LTS 2.150.1. The compare uses the X-Jenkins value the /login response itself served.
Does an affected row mean Stapler deserialization ran?
No. The check only GETs /login and reads X-Jenkins. It does not invoke a Stapler binding and it does not confirm RCE.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public login page. It does not submit forms or call Stapler routes.
Does the check need credentials?
No. It fingerprints the public login page the way an external scanner would.
What is CVE-2018-1000861?
A Stapler binding issue in Jenkins that can lead to remote code execution through unsafe deserialization. This workflow maps hosts to that CVE by version exposure only.