CVE-2019-1003030 PoC — CloudBees Jenkins Pipeline:Groovy Plugin 安全特征问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003030.yaml

Associated Vulnerability

Title: CloudBees Jenkins Pipeline:Groovy Plugin 安全特征问题漏洞 (CVE-2019-1003030)
Description:A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

Description

Jenkins Pipeline: Groovy Plugin (workflow-cps) version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with Overall/Read permission to execute arbitrary code on the Jenkins controller JVM.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →