---
title: "Jenkins Stapler RCE (CVE-2018-1000861)"
canonical: https://trickest.com/library/cve-2018-1000861-jenkins-stapler-deserialization-rce
description: "Flag Jenkins hosts for CVE-2018-1000861 by reading the X-Jenkins header on GET /login. Floors 2.154 / LTS 2.138.4 / 2.150.1. No Stapler invoke."
---

# Jenkins Stapler RCE (CVE-2018-1000861)

## Overview

This workflow finds Jenkins and sorts each host by whether its version falls below the CVE-2018-1000861 fixed floors. CVE-2018-1000861 is a Stapler binding issue that can lead to remote code execution through unsafe deserialization. This check never invokes a Stapler route and never sends a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/login`, fingerprints Jenkins from response markers and the `X-Jenkins` header, reads that version string, and compares it to the weekly and LTS floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when CI controllers lag on LTS bumps. A controller that stayed on 2.138.3 after the advisory is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/login` on each host and fingerprint Jenkins from page markers and the `X-Jenkins` response header.
3. Parse the version from `X-Jenkins` and compare it to the CVE-2018-1000861 floors in the graph (2.154, LTS 2.138.4, LTS 2.150.1).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Jenkins was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/login` only. No Stapler invoke and no deserialization payload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Jenkins host below a CVE-2018-1000861 floor, one at or above its floor, and one host that is not the product.

```jsonl
{"url": "https://ci.example.com", "is_product": true, "product_version": "2.138.3", "vulnerable": true, "detail": "below LTS floor 2.138.4"}
{"url": "https://ci.example.org", "is_product": true, "product_version": "2.154", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Jenkins"}
```

```json
{"cve": "CVE-2018-1000861", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Jenkins versions does this flag?

Builds below the floors in the graph: weekly 2.154, LTS 2.138.4, and LTS 2.150.1. The compare uses the `X-Jenkins` value the `/login` response itself served.

### Does an affected row mean Stapler deserialization ran?

No. The check only GETs `/login` and reads `X-Jenkins`. It does not invoke a Stapler binding and it does not confirm RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not submit forms or call Stapler routes.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2018-1000861?

A Stapler binding issue in Jenkins that can lead to remote code execution through unsafe deserialization. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Jenkins CLI Deser RCE (CVE-2017-1000353)](/library/cve-2017-1000353-jenkins-cli-deserialization-rce). Reach for it when you need the earlier CLI remoting fingerprint on the same fleet.
- [Tomcat Ghostcat AJP (CVE-2020-1938)](/library/cve-2020-1938-tomcat-ghostcat-ajp). Reach for it when the next Java stack check is Ghostcat on adjacent Tomcat hosts.

---
_Markdown source of https://trickest.com/library/cve-2018-1000861-jenkins-stapler-deserialization-rce._