GHSA-gqhm-4h93-rrhg CVE-2018-1000866
Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass
- Severity
- 8.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 1.64%
- Chance of exploitation in the next 30 days. Higher than 76.36% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-269 Improper Privilege Management
- Fix
- Available
- 2 packages have a fixed version
Description
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | < 2.60 |
2.60 |
| org.jenkins-ci.plugins:script-security | < 1.48 |
1.48 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.plugins.workflow:workflow-cps Maven → 2.60
- maven
<dependency><groupId>org.jenkins-ci.plugins.workflow</groupId><artifactId>workflow-cps</artifactId><version>2.60</version></dependency>- gradle
implementation("org.jenkins-ci.plugins.workflow:workflow-cps:2.60")
org.jenkins-ci.plugins:script-security Maven → 1.48
- maven
<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1.48</version></dependency>- gradle
implementation("org.jenkins-ci.plugins:script-security:1.48")
Severity breakdown
CVSS 3.0 8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
References
Advisories
Other links
- github.com/jenkinsci/script-security-plugin/commit/16c862ae9d4038a3edbd8bdfb0fd…
- github.com/jenkinsci/workflow-cps-plugin/commit/0eb89aaf24065dbbdf6db84516ac1a5…
- github.com/jenkinsci/workflow-cps-plugin/commit/e1c56eb6d85d513cb24dfe188e6f592…
- access.redhat.com/errata/RHBA-2019:0326
- access.redhat.com/errata/RHBA-2019:0327
- jenkins.io/security/advisory/2018-10-29
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2019-1003030 Sandbox bypass in Jenkins Pipeline: Groovy Plugin | Critical Known exploited | Also affects org.jenkins-ci.plugins.workflow:workflow-cps |
| CVE-2019-1003029 Sandbox bypass in Script Security Plugin | Critical Known exploited | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-c3jm-9vj7-5v66 Jenkins Script Security Plugin sandbox bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-p334-gfhq-c7w6 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-jv82-75fh-23r7 Missing permission check in Jenkins Script Security Plugin | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-2g4q-9vm9-9fw4 Jenkins Script Security Plugin sandbox bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-v63g-v339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies | Critical | Also affects org.jenkins-ci.plugins:script-security |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor