Description
Jenkins 2.153和更早版本，LTS 2.138.3和更早版本使用的Stapler Web框架中的stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java中存在一个代码执行漏洞，攻击者可以使用该方法调用某些方法通过访问并非旨在通过这种方式调用的特制URL来访问Java对象。
Jenkins MetaClass 存在远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/e52c3e7f-b706-4dd2-a39a-0f67def223ba
https://blog.csdn.net/m0_68045701/article/details/140296557
https://www.cnblogs.com/liang-chen/p/13726375.html
https://nvd.nist.gov/vuln/detail/cve-2018-1000861
https://github.com/vulhub/vulhub/blob/master/jenkins/CVE-2018-1000861/README.md
https://seaii-blog.com/2019/12/29/%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/2019-12-29-Jenkins_rce(CVE-2018-1000861)%E8%B0%83%E8%AF%95%E7%AC%94%E8%AE%B0/
https://juejin.cn/post/6844903791280521230
https://exexute.github.io/2019/03/25/cve-2019-1003000-jenkins%E7%B3%BB%E5%88%97RCE%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
https://www.tenable.com/plugins/was/113160
https://kylingit.com/blog/jenkins-%E8%B7%AF%E7%94%B1%E8%A7%A3%E6%9E%90%E5%8F%8A%E6%B2%99%E7%AE%B1%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E6%8A%A5%E5%91%8A%E4%B8%8A/