CVE-2019-1003033: Jenkins Groovy Plugin sandbox bypass vulnerability
Summary
CVE-2019-1003033: Jenkins Groovy Plugin sandbox bypass vulnerability. Affects org.jenkins-ci.plugins:groovy versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Groovy Plugin is a plugin for the Jenkins automation server that allows users to execute Groovy scripts as part of their build process. It provides a convenient way to automate tasks and customize the build process. The plugin is widely used in the Jenkins community and is an integral part of many Jenkins installations. However, versions 2.1 and earlier of the plugin are vulnerable to a sandbox bypass vulnerability.
Vulnerability Detail
The sandbox bypass vulnerability in the Jenkins Groovy Plugin allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. This vulnerability exists in the pom.xml and src/main/java/hudson/plugins/groovy/StringScriptSource.java files. The vulnerability can be exploited by an attacker to execute malicious code on the Jenkins master, potentially leading to unauthorized access, data breaches, or further compromise of the Jenkins environment. The vulnerability has a CVSS score of 8.8, indicating a high severity.
How To Fix
Minimum fixed version
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins Groovy Plugin.
Conclusion
The Jenkins Groovy Plugin versions 2.1 and earlier are vulnerable to a sandbox bypass vulnerability that allows attackers to execute arbitrary code on the Jenkins master JVM. To mitigate the risk, it is recommended to upgrade to version 2.2 or later of the plugin. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:groovy →
FAQ
The vulnerability allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM, potentially leading to unauthorized access, data breaches, or further compromise of the Jenkins environment.
Users of Jenkins Groovy Plugin versions 2.1 and earlier are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the Jenkins Groovy Plugin.
The CVSS score of this vulnerability is 8.8, indicating a high severity.
For more information about this vulnerability, you can visit the GitHub Advisory Database or contact the Jenkins community.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:groovy.
