PT-2024-25716 · Jenkins · Jenkins Script Security Plugin+1
Devin Nusbaum
·
Published
2024-05-02
·
Updated
2025-10-10
·
CVE-2024-34145
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins Script Security Plugin versions 1335.vf07d9ce377a e and earlier
Description
A sandbox bypass issue involves sandbox-defined classes that shadow specific non-sandbox-defined classes, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. The vulnerability exploits crafted constructor bodies that invoke other constructors and sandbox-defined Groovy classes to construct any subclassable type. This enables attackers to bypass the sandbox feature, which is designed to allow low-privileged users to define scripts that are generally safe to execute.
Recommendations
For Jenkins Script Security Plugin versions 1335.vf07d9ce377a e and earlier, consider disabling the sandbox feature until a patch is available to prevent attackers from bypassing the sandbox protection. Restrict access to the Jenkins controller JVM to minimize the risk of exploitation. Avoid using crafted constructor bodies and sandbox-defined Groovy classes in sandboxed scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Script Security Plugin