CVE-2019-1003002

This Metasploit module exploits CVE-2019-1003002 in Jenkins by bypassing ACLs via dynamic routing and leveraging Groovy metaprogramming to execute arbitrary code. It downloads and executes a malicious JAR file, achieving remote code execution.

This exploit leverages a vulnerability in Jenkins Groovy scripts (CVE-2019-1003002) by crafting a malicious JAR file that executes arbitrary code via the Grape dependency resolver. The PoC demonstrates how to trigger remote code execution by hosting a malicious JAR and referencing it in a Jenkins script console.

This Metasploit module exploits CVE-2018-1000408 in Jenkins by bypassing ACLs via dynamic routing and leveraging Groovy metaprogramming to achieve remote code execution (RCE). It supports two targets: Unix in-memory execution and Java dropper via a malicious JAR file.