PT-2023-1237 · Jenkins · Jenkins Script Security Plugin+1
Devin Nusbaum
·
Published
2023-01-24
·
Updated
2023-02-04
·
CVE-2023-24422
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Jenkins Script Security Plugin versions 1228.vd93135a 2fb 25 and earlier
Description
The issue is related to errors in processing data by map constructors, which can be exploited by a remote attacker to bypass the sandbox and execute arbitrary code in the context of the Jenkins controller JVM. This allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection.
Recommendations
For Jenkins Script Security Plugin versions 1228.vd93135a 2fb 25 and earlier, consider restricting the use of map constructors in sandboxed scripts until a patch is available. As a temporary workaround, limit the permissions for defining and running sandboxed scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jenkins
Jenkins Script Security Plugin