Immunity Canvas: JENKINS_CHECKSCRIPT_RCE

Groovy Plugin supports sandboxed Groovy expressions for its ‘System Groovy’ functionality.
Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.

IMPORTANT:

• Sometimes an exception is generated during the exploitation of a vulnerable target,
  if this happens an error message will be shown and you should re-run the module.

• The module creates a local webserver for the exploit proccess, so it’s necessary that both the target and CANVAS have mutual visibility.

Vulnerable versions:

• < 2.138 (with ANONYMOUS_READ disabled)
• < build time 2019-01-28 (with ANONYMOUS_READ enabled)

Tested on:

• Ubuntu 18.10, Jenkins 2.122

Repeatability: Infinite
References: https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003029 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-1003005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000861
Date public: 17/05/2019