PT-2019-2299 · Jenkins · Jenkins Script Security Plugin+1

Georgy Noseevich + 1 · Publicado 2019-03-06 · Atualizado 2025-10-24 · CVE-2019-1003029

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.53 and earlier

Description A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The issue is related to errors in handling input data during code syntax analysis in the GroovySandbox.java and SecureGroovyScript.java components. This vulnerability can be exploited by a remote attacker to escape the isolated software environment and execute arbitrary code.

Recommendations For Jenkins Script Security Plugin versions 1.53 and earlier, update to a version later than 1.53 to resolve the issue. As a temporary workaround, consider restricting access to the GroovySandbox.java and SecureGroovyScript.java components to minimize the risk of exploitation.

Exploit

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

CWE-96

Identificadores relacionados

BDU:2019-02070

CVE-2019-1003029

GHSA-XVXQ-HQ48-XPHM

RHSA-2019:0739

Produtos afetados

Jenkins

Jenkins Script Security Plugin

Referências · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb · Exploit
• 🔥 https://github.com/orangetw/awesome-jenkins-rce-2019 · Exploit
• https://github.com/jenkinsci/script-security-plugin · Nota
• https://cvedetails.com/cve/CVE-2019-1003029 · Nota
• https://osv.dev/vulnerability/GHSA-xvxq-hq48-xphm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1003029 · Aviso do Fabricante
• https://t.me/cvenotify/29226 · Publicação no Telegram
• http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html · Nota
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003029 · Nota de Segurança
• http://securityfocus.com/bid/107476 · Nota
• https://access.redhat.com/errata/RHSA-2019:0739 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029 · Nota
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1) · Nota
• https://bdu.fstec.ru/vul/2019-02070 · Nota de Segurança