PT-2019-2297 · Jenkins · Jenkins Script Security Plugin+1

Oleg Nenashev · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003005

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.50 and earlier

Description The issue is related to errors in handling Groovy scripts, which can be exploited by a remote attacker to bypass the sandbox and execute arbitrary code on the Jenkins master JVM. This can be achieved by providing a Groovy script to an HTTP endpoint, allowing for arbitrary code execution. The attacker needs Overall/Read permission to exploit this issue.

Recommendations For Jenkins Script Security Plugin versions 1.50 and earlier, update to a version later than 1.50 to resolve the issue. As a temporary workaround, consider restricting access to the SecureGroovyScript.java component to minimize the risk of exploitation. Avoid using the HTTP endpoint that allows Groovy script execution until the issue is resolved.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-264

Related Identifiers

BDU:2019-02068

CVE-2019-1003005

GHSA-X5JM-RJ37-5QH7

RHSA-2019:0739

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb · Exploit
• https://bdu.fstec.ru/vul/2019-02068 · Security Note
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5jm-rj37-5qh7 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0739 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003005 · Security Note
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/35119273101af26792457ec177f34f6f4fa49d99 · Note
• http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html · Note
• https://t.me/cvenotify/29225 · Telegram Post
• https://cvedetails.com/cve/CVE-2019-1003005 · Note
• https://t.me/poxek/2140 · Telegram Post
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-1003005 · Note