Pipeline Groovy Plugin up to 2.61 on Jenkins Sandbox CpsFlowDefinition.java 7pk security

Summaryinfo

A vulnerability marked as critical has been reported in Pipeline Groovy Plugin up to 2.61 on Jenkins. Affected by this vulnerability is an unknown functionality of the file src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java of the component Sandbox. Performing a manipulation results in 7pk security. This vulnerability is reported as CVE-2019-1003001. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability classified as critical has been found in Pipeline Groovy Plugin up to 2.61 on Jenkins (Jenkins Plugin). This affects an unknown code of the file src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java of the component Sandbox. The manipulation with an unknown input leads to a 7pk security vulnerability. CWE is classifying the issue as CWE-254. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

The bug was discovered 01/08/2019. The weakness was disclosed 01/22/2019 (Website). It is possible to read the advisory at jenkins.io. This vulnerability is uniquely identified as CVE-2019-1003001 since 01/22/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. A authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1211 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13428 (Jenkins Multiple Security Vulnerabilities (Security Advisory 2019-01-08)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-129986 and VDB-129988 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Jenkins Plugin

Name

• Pipeline Groovy Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46
• 2.47
• 2.48
• 2.49
• 2.50
• 2.51
• 2.52
• 2.53
• 2.54
• 2.55
• 2.56
• 2.57
• 2.58
• 2.59
• 2.60
• 2.61

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion