CVE-2019-1003005
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Existe una vulnerabilidad de omisión de sandbox en Jenkins Script Security Plugin, en versiones 1.50 y anteriores, en src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java, que permite que los atacantes con permisos Overall/Read proporcionen un script de Groovy a un endpoint HTTP que puede resultar en la ejecución de código arbitrario en el JVM maestro de Jenkins.
A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master. The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-02-06 CVE Reserved
- 2019-02-06 CVE Published
- 2022-04-20 First Exploit
- 2024-06-29 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CAPEC
References (11)
URL | Date | SRC |
---|---|---|
https://github.com/orangetw/awesome-jenkins-rce-2019 | 2022-04-20 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2019:0739 | 2023-10-25 | |
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 | 2023-10-25 | |
https://access.redhat.com/security/cve/CVE-2019-1003005 | 2019-04-10 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1670283 | 2019-04-10 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Jenkins Search vendor "Jenkins" | Script Security Search vendor "Jenkins" for product "Script Security" | <= 1.50 Search vendor "Jenkins" for product "Script Security" and version " <= 1.50" | jenkins |
Affected
|