Exploitation Summary
CVE-2019-1003001 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Orange Tsai, Mikhail Egorov, George Noseevich, wvu, including a Metasploit module exploits/multi/http/jenkins_metaprogramming.
AI-analyzed exploit summary This Metasploit module exploits CVE-2019-1003002 in Jenkins by bypassing ACLs via dynamic routing and leveraging Groovy metaprogramming to execute arbitrary code. It downloads and executes a malicious JAR file, achieving remote code execution.
Description
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Exploits (3)
This Metasploit module exploits CVE-2019-1003002 in Jenkins by bypassing ACLs via dynamic routing and leveraging Groovy metaprogramming to execute arbitrary code. It downloads and executes a malicious JAR file, achieving remote code execution.
This Metasploit module exploits CVE-2019-1003001 in Jenkins by bypassing ACLs via dynamic routing and leveraging Groovy metaprogramming to achieve remote code execution. It supports both in-memory Unix command execution and Java dropper payloads.
This exploit leverages a vulnerability in Jenkins Groovy scripts where a malicious JAR file is fetched via Grape and executed through the Runner service mechanism, achieving remote code execution. The PoC demonstrates how to craft a JAR with a malicious class and trigger its execution via a specially crafted script compilation request.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H