## https://sploitus.com/exploit?id=F9BD6F9A-5137-5925-946C-22A13B5FD40B
PoC exploit for CVE-2019-1003000, CVE-2019-1003001, and CVE-2019-1003002, which are related to Script Security, Pipeline: Groovy, and Pipeline: Declarative plugins in Jenkins. The exploit allows users with Overall/Read permission and Job/Configure (and optional Job/Build) to bypass the sandbox protection and execute arbitrary code on the Jenkins master or node. The payload is a maliciously modified build script in sandbox mode that uses AST transforming annotations @Grab to import arbitrary Java packages from an external Maven repository, allowing the execution of system shell commands. The exploit is demonstrated using a Python script (exploit.py) that connects to a Jenkins server, crafts the payload, modifies the job configuration, puts the job build to the queue, and executes the system command. The vulnerability affects versions of the plugins prior to 1.3.4.1, 2.61.1, and 1.50, respectively.