CVE-2019-1003000

Related Files

Jenkins ACL Bypass / Metaprogramming Remote Code Execution

Posted Mar 19, 2019

Authored by Orange Tsai, wvu | Site metasploit.com

This Metasploit module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. The ACL bypass gadget is specific to Jenkins versions 2.137 and below and will not work on later versions of Jenkins. Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.

tags | exploit

advisories | CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002

SHA-256 | 1fa7a0581a082a2a0c1e14681f05b88994d45c7f8daeb7fbed7b6dacc77b9a72

Download | Favorite | View

Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution

Posted Feb 25, 2019

Authored by wetw0rk, wetw0rk & 0xtavian, 0xtavian

Jenkins plugins Script Security version 1.49, Declarative version 1.3.4, and Groovy version 2.60 suffer from a code execution vulnerability.

tags | exploit, code execution

advisories | CVE-2018-1999002, CVE-2019-1003000

SHA-256 | 1464739307633b75e322eb2e0907ec7933ce2f124fc0c0718f3077cf93613a62

Download | Favorite | View