PT-2020-15508 · Jenkins · Jenkins Script Security Plugin+4

Daniel Beck + 1 · Published 2020-09-23 · Updated 2023-10-25 · CVE-2020-2279

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1.74 and earlier

Description A sandbox bypass issue allows attackers with permission to define sandboxed scripts to execute arbitrary code on the Jenkins controller JVM. This is possible due to the ability of sandboxed scripts to communicate results through return values or script binding content. The vulnerability enables attackers to bypass sandbox protection, resulting in arbitrary code execution.

Recommendations For Jenkins Script Security Plugin versions 1.74 and earlier, update to version 1.75 or later to resolve the issue. Additionally, to ensure compatibility with this update, consider upgrading the following plugins to the specified versions:

• Email Extension Plugin to version 2.77 or newer
• Warnings Next Generation Plugin to version 8.4.3 or newer
• Warnings Plugin to version 5.0.2 or newer As a temporary workaround, consider converting script return values or script binding content to a known safe type, such as String, inside the sandboxed script to prevent potential issues with invocations of sandboxed scripts.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2020-2279

GHSA-CCR8-4XR7-CGJ3

Affected Products

Email Extension Plugin

Jenkins

Jenkins Script Security Plugin

Warnings Next Generation Plugin

Warnings Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2279.json · Exploit
• https://jenkins.io/security/advisory/2020-09-23/#SECURITY-2020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2279 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2279 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ccr8-4xr7-cgj3 · Vendor Advisory
• https://github.com/jenkinsci/script-security-plugin · Note
• https://github.com/jenkinsci/script-security-plugin/commit/79d1e9207c5c359ca779b92f0a290e18c5e2387b · Note
• http://openwall.com/lists/oss-security/2020/09/23/1 · Note