CVE-2019-1003005
published 2019-02-06CVE-2019-1003005: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/Se…
PriorityP272high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
19.04%
97.0th percentile
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | active_directory_plugin | — | — |
| jenkins | blue_ocean_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | from_job_import_plugin | — | — |
| jenkins | git_plugin | — | — |
| jenkins | github_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | jenkins_startup_or_after_monitoring_plugin | — | — |
| jenkins | job_import_plugin | — | — |
| jenkins | kanboard_plugin | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | openid_connect_authentication_plugin | — | — |
| jenkins | script_security | <= 1.50 | — |
| jenkins | script_security_plugin | — | — |
| jenkins | token_macro_plugin | — | — |
| jenkins | warnings_next_generation_plugin | — | — |
| jenkins | warnings_plugin | — | — |
| jenkins | xml_parser_used_in_job_import_plugin | — | — |
| jenkins_project | jenkins_script_security_plugin | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://github.com/jenkinsci/script-security-plugin/commit/35119273101af26792457ec177f34f6f4fa49d99↗
- →Monitor HTTP endpoints in Jenkins that accept user-submitted Groovy scripts for the presence of AST transforming annotations such as @Grab in submitted source code, which is the exploitation vector for sandbox bypass during the script compilation phase. ↗
- →Alert on requests to the Jenkins HTTP endpoint used to validate user-submitted Groovy scripts (script validation endpoint) originating from users with only Overall/Read permission, particularly when the submitted payload contains AST transformation annotations. ↗
- →This CVE is an incomplete fix for CVE-2019-1003000 (SECURITY-1266); detections for @Grab and similar AST-transforming annotations in Groovy script submissions should cover both CVEs. ↗
- ·The vulnerability affects Jenkins Script Security Plugin version 1.50 and earlier only; instances running a patched version (post-1.50) that applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations are not affected. ↗
- ·Red Hat OpenShift Container Platform versions 3.2 through 3.10 are listed as 'Will not fix', meaning patched container images may not be available for those versions; detection and mitigation remain the primary controls. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Sandbox Bypass in Script Security Plugin
osv·2022-05-13
CVE-2019-1003005 [HIGH] Sandbox Bypass in Script Security Plugin
Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
GHSA
Sandbox Bypass in Script Security Plugin
ghsa·2022-05-13
CVE-2019-1003005 [HIGH] CWE-693 Sandbox Bypass in Script Security Plugin
Sandbox Bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Red Hat
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
vendor_redhat·2019-01-29·CVSS 8.8
CVE-2019-1003005 [HIGH] CWE-96 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a u
Jenkins
Jenkins Security Advisory 2019-01-28
vendor_jenkins·2019-01-28·CVSS 8.8
CVE-2019-1003005 [HIGH] Jenkins Security Advisory 2019-01-28
Title: Jenkins Security Advisory 2019-01-28
Jenkins Security Advisory 2019-01-28
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Active Directory
Plugin
Blue Ocean
Plugin
Config File Provider
Plugin
Git
Plugin
GitHub Authentication
Plugin
Groovy
Plugin
Job Import
Plugin
Job Import
Plugin
No detection rules found.
Bugzilla
CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
bugzilla·2019-01-29·CVSS 8.8
CVE-2019-1003005 [HIGH] CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
CVE-2019-1003005 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292)
Jenkins Script Security plugin through version 1.50 is vulnerable to an incomplete fix to CVE-2019-1003000.
Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.
This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations.
External Refe
Bugzilla
CVE-2019-1003005 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292) [fedora-all]
bugzilla·2019-01-29·CVSS 8.8
CVE-2019-1003005 [HIGH] CVE-2019-1003005 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292) [fedora-all]
CVE-2019-1003005 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fed
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttps://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292
2019-02-06
Published