CVE-2019-1003006: Jenkins Groovy Plugin sandbox bypass vulnerability
Summary
CVE-2019-1003006: Jenkins Groovy Plugin sandbox bypass vulnerability. Affects org.jenkins-ci.plugins:groovy versions < 2.1. Fixed in 2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Groovy Plugin is a tool that allows users to execute Groovy scripts within Jenkins. It provides a sandbox environment to ensure the security of the execution. However, versions 2.0 and earlier of the plugin contain a sandbox bypass vulnerability that can be exploited by attackers with Overall/Read permission. By providing a malicious Groovy script to an HTTP endpoint, an attacker can execute arbitrary code on the Jenkins master JVM. This vulnerability has a CVSS score of 8.8, indicating a high severity level.
Vulnerability Detail
The vulnerability resides in the StringScriptSource.java file of the Jenkins Groovy Plugin. It allows attackers with Overall/Read permission to submit a Groovy script to an HTTP endpoint, which can lead to arbitrary code execution on the Jenkins master JVM. The affected HTTP endpoint in version 2.0 and earlier does not apply a safe Groovy compiler configuration, allowing the use of unsafe AST transforming annotations. However, in version 2.1, this vulnerability is addressed by applying a safe Groovy compiler configuration that prevents the use of unsafe AST transforming annotations.
How To Fix
Minimum fixed version
2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users with appropriate permissions have Overall/Read access. Additionally, monitoring and restricting access to the HTTP endpoint where Groovy scripts can be submitted can help prevent exploitation.
Conclusion
The Jenkins Groovy Plugin versions 2.0 and earlier are vulnerable to a sandbox bypass vulnerability that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. To mitigate this vulnerability, it is crucial to upgrade to version 2.1 or later of the plugin. This version includes a safe Groovy compiler configuration that prevents the use of unsafe AST transforming annotations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:groovy →
FAQ
The vulnerability allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM, potentially leading to unauthorized access, data breaches, or system compromise.
Users of Jenkins Groovy Plugin versions 2.0 and earlier are affected by this vulnerability. Specifically, attackers with Overall/Read permission can exploit this vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is important to apply the recommended fix to prevent potential exploitation.
Upgrading to version 2.1 or later of the Jenkins Groovy Plugin is the recommended mitigation for this vulnerability. This version includes a safe Groovy compiler configuration that prevents the use of unsafe AST transforming annotations.
Yes, this vulnerability has a CVSS score of 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:groovy.
