PT-2019-2299 · Jenkins · Jenkins Script Security Plugin+1

Georgy Noseevich + 1 · Published 2019-03-06 · Updated 2025-10-24 · CVE-2019-1003029

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.53 and earlier

Description A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The issue is related to errors in handling input data during code syntax analysis in the GroovySandbox.java and SecureGroovyScript.java components. This vulnerability can be exploited by a remote attacker to escape the isolated software environment and execute arbitrary code.

Recommendations For Jenkins Script Security Plugin versions 1.53 and earlier, update to a version later than 1.53 to resolve the issue. As a temporary workaround, consider restricting access to the GroovySandbox.java and SecureGroovyScript.java components to minimize the risk of exploitation.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-96

Related Identifiers

BDU:2019-02070

CVE-2019-1003029

GHSA-XVXQ-HQ48-XPHM

RHSA-2019:0739

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/jenkins_metaprogramming.rb · Exploit
• 🔥 https://github.com/orangetw/awesome-jenkins-rce-2019 · Exploit
• https://osv.dev/vulnerability/GHSA-xvxq-hq48-xphm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003029 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0739 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02070 · Security Note
• https://github.com/jenkinsci/script-security-plugin · Note
• https://cvedetails.com/cve/CVE-2019-1003029 · Note
• https://t.me/cvenotify/29226 · Telegram Post
• http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• http://securityfocus.com/bid/107476 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029 · Note
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1) · Note