CVE-2019-1003029criticalunder attack

CVE-2019-1003029: critical vulnerability in Jenkins Script Security Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Script Security Plugin+ Monitor org.jenkins-ci.plugins:script-security

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.9epss 74%
from disclosure to weaponsame day
Published on NVDMar 8
metasploitJan 8
CISA KEV+1144d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
6 products (10 components)
Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.6 · Red Hat OpenShift Container Platform 3.7 · Red Hat OpenShift Container Platform 3.9 · Red Hat OpenShift Container Platform 3.4 · and others 1
no_fix_planned: Will not fix
Fixed
1 product (2 components)
Red Hat OpenShift Container Platform 3.11
fix ↗
Not affected
1 product (2 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4
Action required by CISAfederal deadline: 2022-05-16

Apply updates per vendor instructions.

In short

Jenkins Script Security Plugin has a flaw that lets users with basic read access escape the sandbox and run any code on the Jenkins server. This is dangerous because it gives attackers full control over the Jenkins system.

Technical detail

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.53 and earlier allows attackers with Overall/Read permissions to execute arbitrary code on the Jenkins master JVM through improper sandboxing of Groovy script execution. The vulnerability exists in the GroovySandbox and SecureGroovyScript classes, enabling code execution with Jenkins master privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Jenkins project · Jenkins Script Security Plugin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Jenkins Script Security Plugin

In the same product, most dangerous first.

CVE-2019-1003005—CVE-2019-1003005EPSS 19.5%CVE-2019-1003040—CVE-2019-1003040EPSS 3.4%CVE-2019-1003024—CVE-2019-1003024EPSS 3.1%CVE-2019-10431—CVE-2019-10431EPSS 2.8%CVE-2019-10355—CVE-2019-10355EPSS 2.5%CVE-2019-10356—CVE-2019-10356EPSS 2.5%