SB2018121029 - Sandbox restrictions bypass in Pipeline: Groovy plugin for Jenkins

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018121029

SB2018121029 - Sandbox restrictions bypass in Pipeline: Groovy plugin for Jenkins

Published: December 10, 2018 Updated: October 7, 2019

Security Bulletin ID SB2018121029
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper access control (CVE-ID: CVE-2018-1000866)

The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists in "groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java" and "groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java" due to the Groovy Sandbox library does not apply sandbox restrictions to finalize methods. A remote authenticated attacker with Job/Configure permission, or non-authenticated attacker with SCM commit privileges and corresponding pipelines based on Jenkins files set up in Jenkins, can bypass the sandbox protection and execute arbitrary code on the Jenkins master.


Remediation

Install update from vendor's website.

References