GHSA-2g4q-9vm9-9fw4 CVE-2024-34145
Jenkins Script Security Plugin sandbox bypass vulnerability
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.00%
- Chance of exploitation in the next 30 days. Higher than 62.88% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-290 Authentication Bypass by Spoofing
- Fix
1336.vf33a- Upgrade org.jenkins-ci.plugins:script-security to this version or later
Description
Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.
Multiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:
-
Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.
-
Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.
These vulnerabilities allow attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins:script-security | < 1336.vf33a |
1336.vf33a |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.plugins:script-security Maven → 1336.vf33a
- maven
<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1336.vf33a</version></dependency>- gradle
implementation("org.jenkins-ci.plugins:script-security:1336.vf33a")
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-1003029 Sandbox bypass in Script Security Plugin | Critical Known exploited | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-c3jm-9vj7-5v66 Jenkins Script Security Plugin sandbox bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-p334-gfhq-c7w6 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-jv82-75fh-23r7 Missing permission check in Jenkins Script Security Plugin | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-v63g-v339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies | Critical | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-76qj-9gwh-pvv3 Sandbox bypass in Jenkins Script Security Plugin | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-fv42-mx39-6fpw Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions | High | Also affects org.jenkins-ci.plugins:script-security |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor