CVE-2024-34144
published 2024-05-02CVE-2024-34144: A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
48.08%
98.7th percentile
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | git_server_plugin | — | — |
| jenkins | script_security | <= 1335.vf07d9ce377a_e | — |
| jenkins | script_security_plugin | — | — |
| jenkins | subversion_partial_release_manager_plugin | — | — |
| jenkins | telegram_bot_plugin | — | — |
| jenkins_project | jenkins_script_security_plugin | <= 1335.vf07d9ce377a_e | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Sandbox bypass via crafted constructor bodies that trigger other constructors, allowing construction of any subclassable type through implicit casts in Jenkins Script Security Plugin ↗
- →Sandbox bypass via Groovy classes defined within the sandbox that overshadow certain non-sandboxed classes, facilitating creation of any subclassable type ↗
- →Calls to super constructors and 'this' constructor chaining are not intercepted by the sandbox in vulnerable versions — monitor sandboxed Pipeline/Groovy scripts making unusual constructor calls ↗
- →Classes in packages that can be overshadowed by Groovy-defined classes were not checked during super constructor call interception — flag sandboxed scripts defining classes that shadow standard Java/Groovy packages ↗
- ·Vulnerability affects Jenkins Script Security Plugin versions up to and including 1335.vf07d9ce377a_e; upgrade beyond this version to obtain the fix ↗
- ·Exploitation requires the attacker to already have permission to define and run sandboxed scripts (including Pipelines) on the Jenkins controller — not an unauthenticated attack vector ↗
- ·Jenkins (jenkins-2-plugins) on Red Hat OpenShift Container Platform 3.11 is out of support scope and will not receive a fix from Red Hat ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
ghsa·2024-05-02
CVE-2024-34144 [HIGH] CWE-693 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.
Multiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:
- Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.
- Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.
These vulnerabili
OSV
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
osv·2024-05-02
CVE-2024-34144 [HIGH] Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies
Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.
Multiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:
- Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.
- Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.
These vulnerabili
Red Hat
jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies
vendor_redhat·2024-05-02·CVSS 9.8
CVE-2024-34144 [CRITICAL] CWE-693 jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies
jenkins-plugin/script-security: sandbox bypass via crafted constructor bodies
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin involving crafted constructor bodies, enabling the circumvention of security restrictions. With crafted constructor bodies, this flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protection mechanisms and executing arbitrary code within the con
Jenkins
Jenkins Security Advisory 2024-05-02
vendor_jenkins·2024-05-02·CVSS 9.8
CVE-2016-3721 [CRITICAL] Jenkins Security Advisory 2024-05-02
Title: Jenkins Security Advisory 2024-05-02
Jenkins Security Advisory 2024-05-02
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Git server
Plugin
Script Security
Plugin
Subversion Partial Release Manager
Plugin
Telegram Bot
Plugin
Descriptions
Multiple sandbox bypass vulnerabilities in Script Security
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-02
Published