CVE-2019-1003029
published 2019-03-08CVE-2019-1003029: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/Gr…
PriorityP195critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-16
Exploited in the wild
EPSS
74.44%
99.5th percentile
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | appdynamics_dashboard_plugin | — | — |
| jenkins | azure_vm_agents_plugin | — | — |
| jenkins | azure_vm_in_azure_vm_agents_plugin | — | — |
| jenkins | bitbar_run-in-cloud_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | deploy_plugin | — | — |
| jenkins | email_extension_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | ids_in_azure_vm_agents_plugin | — | — |
| jenkins | ids_to_allow_administrators_configuring_the_plugin | — | — |
| jenkins | job_dsl_plugin | — | — |
| jenkins | matrix_project_plugin | — | — |
| jenkins | rabbit-mq_publisher_plugin | — | — |
| jenkins | rabbitmq_in_rabbit-mq_publisher_plugin | — | — |
| jenkins | repository_connector_plugin | — | — |
| jenkins | script_security | <= 1.53 | — |
| jenkins | script_security_plugin | — | — |
| jenkins | this_allowed_users_able_to_control_the_plugin | — | — |
| jenkins_project | jenkins_script_security_plugin | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable component: Jenkins Script Security Plugin version 1.53 and earlier — sandbox bypass allows arbitrary code execution on Jenkins master JVM by any user with Overall/Read permission ↗
- →Exploitation requires only Overall/Read Jenkins permission — monitor for unexpected process spawning or outbound connections originating from the Jenkins master JVM process, especially triggered by Groovy script execution paths in GroovySandbox.java or SecureGroovyScript.java ↗
- ·Affected source files are GroovySandbox.java and SecureGroovyScript.java within the Script Security Plugin; patch was delivered via RHSA-2019:0739 for Red Hat OpenShift Container Platform 3.11, but multiple OCP versions (3.4–3.10) are marked 'Will not fix' ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck9.9CRITICAL
cisa9.9CRITICAL
vendor_redhat9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Sandbox bypass in Script Security Plugin
ghsa·2022-05-13
CVE-2019-1003029 [CRITICAL] CWE-693 Sandbox bypass in Script Security Plugin
Sandbox bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
OSV
Sandbox bypass in Script Security Plugin
osv·2022-05-13
CVE-2019-1003029 [CRITICAL] Sandbox bypass in Script Security Plugin
Sandbox bypass in Script Security Plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
VulnCheck
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
vulncheck·2019·CVSS 9.9
CVE-2019-1003029 [CRITICAL] Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
Affected: Jenkins Script Security Plugin
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-16
CISA
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
cisa·2022-04-25·CVSS 9.9
CVE-2019-1003029 [CRITICAL] Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Vulnerability: Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Affected: Jenkins Script Security Plugin
Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1003029
Remediation Due Date: 2022-05-16
Jenkins
Jenkins Security Advisory 2019-03-06
vendor_jenkins·2019-03-06·CVSS 9.9
CVE-2019-1003029 [CRITICAL] Jenkins Security Advisory 2019-03-06
Title: Jenkins Security Advisory 2019-03-06
Jenkins Security Advisory 2019-03-06
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
AppDynamics Dashboard
Plugin
Azure VM Agents
Plugin
Bitbar Run-in-Cloud
Plugin
Email Extension
Plugin
Groovy
Plugin
Job DSL
Plugin
Matrix Project
Plugin
OSF Bui
Red Hat
jenkins-plugin-script-security: sandbox bypass in script security plugin
vendor_redhat·2019-03-06·CVSS 9.9
CVE-2019-1003029 [CRITICAL] CWE-96 jenkins-plugin-script-security: sandbox bypass in script security plugin
jenkins-plugin-script-security: sandbox bypass in script security plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
A flaw was found in the Jenkins Script Security plugin version 1.53. An attacker with Overall/Read permissions is able to escape the sandbox and execute arbitrary code on the Jenkins master JVM. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: jenkins-2-plugins (Red Hat OpenS
No detection rules found.
Bugzilla
CVE-2019-1003029 jenkins-script-security-plugin: jenkins-plugin-script-security: sandbox bypass in script security plugin [fedora-all]
bugzilla·2019-03-18·CVSS 9.9
CVE-2019-1003029 [CRITICAL] CVE-2019-1003029 jenkins-script-security-plugin: jenkins-plugin-script-security: sandbox bypass in script security plugin [fedora-all]
CVE-2019-1003029 jenkins-script-security-plugin: jenkins-plugin-script-security: sandbox bypass in script security plugin [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit messa
Bugzilla
CVE-2019-1003029 jenkins-plugin-script-security: sandbox bypass in script security plugin
bugzilla·2019-03-18·CVSS 9.9
CVE-2019-1003029 [CRITICAL] CVE-2019-1003029 jenkins-plugin-script-security: sandbox bypass in script security plugin
CVE-2019-1003029 jenkins-plugin-script-security: sandbox bypass in script security plugin
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Reference:
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20
Discussion:
Created jenkins-script-security-plugin tracking bugs for this issue:
Affects: fedora-all [bug 1689874]
---
External References:
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20
---
This issue has been addressed in the foll
http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttp://www.securityfocus.com/bid/107476https://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlhttp://www.securityfocus.com/bid/107476https://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029
2019-03-08
Published
2022-04-25
Added to CISA KEV
Exploited in the wild