1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1754

[JENKINS:SECURITY-1754] Sandbox bypass vulnerability in `script-security`

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

Sandbox protection in script-security 1.70 and earlier can be circumvented through:

  • Crafted constructor calls and bodies (due to an incomplete fix of link:/security/advisory/2017-08-07/#super-constructor-calls[SECURITY-582])
  • Crafted method calls on objects that implement GroovyInterceptable

This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.

script-security 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox.
In addition, it also intercepts method calls on objects that implement GroovyInterceptable as calls to GroovyObject#invokeMethod(String, Object), which is on the list of dangerous signatures and should not be approved for use in the sandbox.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/script-security <= 1.70
pkg:github/jenkinsci/script-security-plugin <= 1.70
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/script-security = 1.71
pkg:github/jenkinsci/script-security-plugin = 1.71
ID
JENKINS:SECURITY-1754
Severity
high
Published
2020-03-09T00:00:00
(4 years ago)
Modified
2020-03-09T00:00:00
(4 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository script-security repository https://github.com/jenkinsci/script-security-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/script-security org.jenkins-ci.plugins script-security <= 1.70
Fixed pkg:maven/org.jenkins-ci.plugins/script-security org.jenkins-ci.plugins script-security = 1.71
Affected pkg:github/jenkinsci/script-security-plugin jenkinsci script-security-plugin <= 1.70
Fixed pkg:github/jenkinsci/script-security-plugin jenkinsci script-security-plugin = 1.71
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date