Sploitus

Exploit for Immunity Canvas: JENKINS_CHECKSCRIPT_RCE

canvas · 2019-03-08

Exploit Code

MARKDOWN30 lines
## https://sploitus.com/exploit?id=JENKINS_CHECKSCRIPT_RCE
**Name**|  jenkins_checkscript_rce  
---|---  
**CVE**|  CVE-2019-1003029  
**Exploit Pack**|  [CANVAS](<http://http://www.immunityinc.com/products-canvas.shtml>)  
**Description**| RCE on Jenkins checkScript  
**Notes**| CVE Name: CVE-2019-1003029 CVE-2019-1003005 CVE-2018-1000861  
VENDOR: Jenkins  
NOTES:   
  
Groovy Plugin supports sandboxed Groovy expressions for its 'System Groovy' functionality.  
Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.  
  
IMPORTANT:  
* Sometimes an exception is generated during the exploitation of a vulnerable target,  
if this happens an error message will be shown and you should re-run the module.  
  
* The module creates a local webserver for the exploit proccess, so it's necessary that both the target and CANVAS have mutual visibility.  
  
Vulnerable versions:  
* &lt; 2.138 (with ANONYMOUS_READ disabled)  
* &lt; build time 2019-01-28 (with ANONYMOUS_READ enabled)  
  
Tested on:  
* Ubuntu 18.10, Jenkins 2.122  
  
Repeatability: Infinite  
References: https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338  
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003029 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000861  
Date public: 17/05/2019