Sandbox Bypass Affecting org.jenkins-ci.plugins:script-security package, versions [,1.63)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-466731
- published 13 Sep 2019
- disclosed 12 Sep 2019
- credit Nils Emmerich of ERNW Research GmbH
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Affected versions of this package are vulnerable to Sandbox Bypass. Sandbox protection in Script Security Plugin could be circumvented through any of the following:
Crafted method names in method call expressions (CVE-2019-10393)
Crafted property names in property expressions on the left-hand side of assignment expressions (CVE-2019-10394)
Crafted property names in property expressions in increment and decrement expressions (CVE-2019-10399)
Crafted subexpressions in increment and decrement expressions not involving actual assignment (CVE-2019-10400)
This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the Jenkins master JVM.