CVE-2019-1003001: High severity jenkins pipeline vulnerability
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Other sources
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.
Both the pipeline validation REST APIs and actual script/pipeline execution are affected.
This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.
All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003001?
CVE-2019-1003001 has a high severity rating, indicating a significant risk to affected systems.
How do I fix CVE-2019-1003001?
To fix CVE-2019-1003001, upgrade the affected plugins to their respective fixed versions as specified in the advisory.
Which versions are affected by CVE-2019-1003001?
CVE-2019-1003001 affects Pipeline: Groovy Plugin version 2.61 and earlier.
What types of systems are impacted by CVE-2019-1003001?
CVE-2019-1003001 impacts systems running Jenkins and related plugins that allow Overall/Read permission.
Can CVE-2019-1003001 lead to remote code execution?
Yes, CVE-2019-1003001 can potentially allow attackers to execute arbitrary code on the affected systems.