PT-2022-20399 · Jenkins · Jenkins Pipeline: Groovy Plugin+1

Jesse Glick · Published 2022-05-17 · Updated 2023-12-21 · CVE-2022-30945

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier

Description The issue allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. This could potentially be used to bypass sandbox protections if a suitable Groovy source file is available. However, the severity of this issue is considered High due to the potential impact, but successful exploitation is considered very unlikely. The estimated number of potentially affected devices is not provided.

Recommendations For Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier, update to version 2692.v76b 089ccd026 or later, which restricts which Groovy source files can be loaded in Pipelines. As a temporary workaround, consider restricting access to Groovy source files on the classpath of Jenkins to minimize the risk of exploitation. Plugins can add specific Groovy source files to the allowlist using the new extension point org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist if necessary.

Fix

Unrestricted File Upload

Files Accessible to External Parties

Weakness Enumeration

CWE-434

CWE-552

Related Identifiers

CVE-2022-30945

GHSA-2XVX-RW9P-XGFC

RHSA-2023:0017

Affected Products

Jenkins

Jenkins Pipeline: Groovy Plugin

References · 10

• https://osv.dev/vulnerability/GHSA-2xvx-rw9p-xgfc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30945 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30945 · Security Note
• https://github.com/jenkinsci/workflow-cps-plugin · Note
• https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2 · Note
• https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db · Note
• http://openwall.com/lists/oss-security/2022/05/17/8 · Note
• https://t.me/cvenotify/37887 · Telegram Post
• https://t.me/cvenotify/64774 · Telegram Post