GHSA-6q78-6xvr-26fg

Source

https://github.com/advisories/GHSA-6q78-6xvr-26fg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6q78-6xvr-26fg/GHSA-6q78-6xvr-26fg.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6q78-6xvr-26fg

Aliases

CVE-2019-1003001

Published

2022-05-13T01:15:20Z

Modified

2024-12-02T05:47:15.799367Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jenkins Groovy Plugin sandbox bypass vulnerability

Details

Jenkins Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements.

Both the pipeline validation REST APIs and actual script/pipeline execution are affected.

This allowed users with Overall/Read permission, or able to control Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the sandbox protection and execute arbitrary code on the Jenkins controller.

All known unsafe AST transformations in Groovy are now prohibited in sandboxed scripts.

Database specific

{
    "nvd_published_at": "2019-01-22T14:29:00Z",
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T21:19:55Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins.workflow:workflow-cps-parent

Package

Name: org.jenkins-ci.plugins.workflow:workflow-cps-parent; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.61.1

Database specific

{
    "last_known_affected_version_range": "<= 2.61"
}

Maven / org.jenkins-ci.plugins:pipeline-model-definition

Package

Name: org.jenkins-ci.plugins:pipeline-model-definition; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/pipeline-model-definition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.4.1

Database specific

{
    "last_known_affected_version_range": "<= 1.3.4"
}

Maven / org.jenkins-ci.plugins:script-security

Package

Name: org.jenkins-ci.plugins:script-security; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/script-security

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.50

Affected versions

1.*

1.0-beta-1

1.0-beta-2

1.0-beta-3

1.0-beta-4

1.0-beta-5

1.0-beta-6

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.18

1.18.1

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.29.1

1.30

1.31

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.44.1

1.45

1.46

1.46.1

1.47

1.48

1.49

Database specific

{
    "last_known_affected_version_range": "<= 1.49"
}