CVE-2019-1003005: High severity jenkins script security vulnerability
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Other sources
Jenkins Script Security plugin through version 1.50 is vulnerable to an incomplete fix to CVE-2019-1003000.
Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.
This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations.
External Reference:
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292
Upstream patches:
https://github.com/jenkinsci/script-security-plugin/commit/35119273101af26792457ec177f34f6f4fa49d99
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003005?
CVE-2019-1003005 is rated as a high severity vulnerability.
How do I fix CVE-2019-1003005?
To fix CVE-2019-1003005, upgrade Jenkins Script Security Plugin to version 1.51 or later.
Who is impacted by CVE-2019-1003005?
CVE-2019-1003005 impacts Jenkins installations using Script Security Plugin version 1.50 and earlier.
What kind of vulnerability is CVE-2019-1003005?
CVE-2019-1003005 is a sandbox bypass vulnerability allowing unauthorized script execution.
What permissions are required to exploit CVE-2019-1003005?
Exploitation of CVE-2019-1003005 requires Overall/Read permission on Jenkins.