cve/2019/CVE-2019-1003030.md

CVE-2019-1003030

Description

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

POC

Reference

• http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/BLACKHAT-SSG/Pwn_Jenkins
• https://github.com/Cashiuus/jenkins-checkscript-rce
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/PwnAwan/Pwn_Jenkins
• https://github.com/Rajchowdhury420/Secure-or-Break-Jenkins
• https://github.com/gquere/pwn_jenkins
• https://github.com/retr0-13/pwn_jenkins