PT-2022-26887 · Jenkins · Jenkins Script Security Plugin+1

Daniel Beck + 1 · Published 2022-10-19 · Updated 2023-11-22 · CVE-2022-43403

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1183.v774b 0b 0a a 451 and earlier

Description A sandbox bypass issue involves casting an array-like value to an array type, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Recommendations For Jenkins Script Security Plugin versions 1183.v774b 0b 0a a 451 and earlier, update to a version that intercepts per-element casts when casting array-like values to array types, such as version 1184.v85d16b d851b 3 or later.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-43403

GHSA-F6MQ-6FX5-W2CH

RHSA-2023:0560

RHSA-2023:0777

RHSA-2023:1064

RHSA-2023:3198

Affected Products

Jenkins

Jenkins Script Security Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-43403 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43403 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6mq-6fx5-w2ch · Vendor Advisory
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now · Note
• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1) · Note