CVE-2019-1003002: High severity jenkins pipeline vulnerability
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Other sources
Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.
Both the pipeline validation REST APIs and actual script/pipeline execution are affected.
This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.
All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003002?
CVE-2019-1003002 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2019-1003002?
To fix CVE-2019-1003002, update the Pipeline: Declarative Plugin to version 1.3.4.1 or later.
Who is affected by CVE-2019-1003002?
CVE-2019-1003002 affects users of Pipeline: Declarative Plugin versions 1.3.3 and earlier.
What type of vulnerability is CVE-2019-1003002?
CVE-2019-1003002 is a sandbox bypass vulnerability.
What can an attacker do with CVE-2019-1003002?
An attacker with Overall/Read permission can provide a malicious pipeline script to an HTTP endpoint, potentially leading to code execution.