Patchfirst
Patchfirst
CVE-2019-1003029 KEVPublic exploit Critical · 9.9 EPSS 74.4%

Jenkins Script Security Plugin Sandbox Bypass Vulnerability

Jenkins · Script Security Plugin

Summary

The Jenkins Script Security Plugin, version 1.53 and earlier, contains a sandbox bypass flaw in its Groovy sandbox and secure script components (GroovySandbox.java and SecureGroovyScript.java). An attacker reachable over the network who holds Overall/Read permission, and needs no user interaction, can execute arbitrary code on the Jenkins master JVM.

Official description · NVD

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

Breakdown
69.8 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 3 years after disclosure. Public exploit code (Metasploit) was available 59 days before disclosure.

  1. Public exploit codeMetasploit59 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+3 yrs
  4. Added to CISA KEVEU database agrees+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

7 fixes in script-security over 6 months. The latest fix listed for script-security is 1.62.

Fixes in script-securityMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.50CVE-2019-100300122 Jan 2019
  2. 1.51CVE-2019-10030056 Feb 2019
  3. 1.53CVE-2019-100302420 Feb 2019
  4. 1.54CVE-2019-10030298 Mar 2019KEV
  5. 1.56CVE-2019-100304028 Mar 2019
  6. 1.62CVE-2019-1035531 Jul 2019
  7. 1.62CVE-2019-1035631 Jul 2019Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Exploited via network-accessible Jenkins application interface

allows attackers with Overall/Read permission to execute arbitrary code
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Arbitrary code executes on Jenkins master JVM

allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-1003029 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:script-security.

Mavenorg.jenkins-ci.plugins:script-securityGHSA-xvxq-hq48-xphm

Upgrade to 1.54 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2019-1003000, CVE-2019-1003001).

Set the version to 1.54 or later in your pom.xml or build.gradle.

The first fix for CVE-2019-1003029.

Affected versions

If you runUpgrade to
All versions before 1.541.54

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

5 links, grouped by NVD tag (4 duplicates merged)

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029

Third Party Advisory 4

packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.htmlsecurityfocus.com/bid/107476access.redhat.com/errata/RHSA-2019:0739jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29
↑ ↓ chooseEnter openEsc close