Jenkins · Matrix Project Plugin
The Matrix Project Plugin for Jenkins contains a remote code execution flaw in its Pipeline: Groovy component, where a sandbox bypass lets scripts escape restrictions and run arbitrary code on the Jenkins master JVM. An attacker who can control pipeline scripts, which requires low-privileged authentication, can exploit this over the network without any user interaction.
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
First seen exploited 3 years after disclosure. Public exploit code (Exploit-DB) appeared 19 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
6 fixes in workflow-cps over 4 years. The latest fix listed for workflow-cps is 2648.2651.v230593e03e9f.
Exploited via attacker-controlled pipeline scripts on public Jenkins
A sandbox bypass vulnerability exists in Jenkins Pipeline
Arbitrary code execution on Jenkins master JVM
allows attackers able to control pipeline scripts to execute arbitrary code
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins.workflow:workflow-cps.
Upgrade to 2.64 or later
Set the version to 2.64 or later in your pom.xml or build.gradle.
The first fix for CVE-2019-1003030. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 2.64 | 2.64 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.