Sandbox Bypass and RCE in Jenkins Pipeline: Declarative Plugin

This repository contains a Metasploit module (jenkins_metaprogramming.rb) that exploits multiple vulnerabilities in Jenkins (CVE-2018-1000861, CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002, CVE-2019-1003005, CVE-2019-1003029) to achieve unauthenticated remote code execution (RCE) by bypassing the Overall/Read ACL and leveraging Groovy metaprogramming. The exploit targets Jenkins version 2.137 and below, specifically when the Pipeline: Groovy Plugin 2.61 is installed. It provides two main attack vectors: (1) Unix In-Memory, which executes arbitrary shell commands in memory, and (2) Java Dropper, which delivers and executes a malicious JAR file via Groovy's @Grab annotation. The module is highly weaponized, allowing the attacker to select payloads (reverse shell, Meterpreter, etc.) and automatically handles the delivery and execution of the payload. The main endpoints targeted are Jenkins HTTP API routes related to user search and Groovy script compilation. The code is structured as a typical Metasploit module, with clear separation of check, exploit, and payload delivery logic.