## https://sploitus.com/exploit?id=JENKINS_CHECKSCRIPT_RCE
**Name**| jenkins_checkscript_rce
---|---
**CVE**| CVE-2019-1003029
**Exploit Pack**| [CANVAS](<http://http://www.immunityinc.com/products-canvas.shtml>)
**Description**| RCE on Jenkins checkScript
**Notes**| CVE Name: CVE-2019-1003029 CVE-2019-1003005 CVE-2018-1000861
VENDOR: Jenkins
NOTES:
Groovy Plugin supports sandboxed Groovy expressions for its 'System Groovy' functionality.
Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
IMPORTANT:
* Sometimes an exception is generated during the exploitation of a vulnerable target,
if this happens an error message will be shown and you should re-run the module.
* The module creates a local webserver for the exploit proccess, so it's necessary that both the target and CANVAS have mutual visibility.
Vulnerable versions:
* < 2.138 (with ANONYMOUS_READ disabled)
* < build time 2019-01-28 (with ANONYMOUS_READ enabled)
Tested on:
* Ubuntu 18.10, Jenkins 2.122
Repeatability: Infinite
References: https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003029 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000861
Date public: 17/05/2019