CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
Description
CVE-2019-1003029 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin, a protection mechanism designed to restrict the execution of Groovy scripts within Jenkins pipelines. This vulnerability allows an attacker with permissions to define or configure pipeline scripts to bypass the Groovy sandbox and execute arbitrary code on the Jenkins master server. The protection mechanism failure in the Jenkins Script Security Plugin effectively negates the security boundary intended to prevent untrusted scripts from accessing the underlying operating system. CISA has added CVE-2019-1003029 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, and the EPSS percentile of approximately 99.7% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jenkins | script security | <= 1.53 |
| redhat | openshift container platform | 3.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/107476(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2019:0739(Third Party Advisory)
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%281%29(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003029(US Government Resource)
Weakness Type
CWE-693: Protection Mechanism Failure
The vulnerability in the Jenkins Script Security Plugin represents a protection mechanism failure where the Groovy sandbox, designed to restrict script execution capabilities, can be bypassed by an attacker. The sandbox is intended to prevent pipeline scripts from executing dangerous operations such as accessing the file system, running system commands, or interacting with internal Jenkins APIs. CVE-2019-1003029 allows an attacker to escape these restrictions and execute arbitrary code with the full privileges of the Jenkins process.
Learn more: CWE-693 — Protection Mechanism Failure
Impact Analysis
CVE-2019-1003029 is exploitable over the network by any user with permissions to configure or execute Jenkins pipeline scripts, making it a critical threat in environments where Jenkins is accessible to multiple users or teams. The sandbox bypass allows an attacker to execute arbitrary code on the Jenkins master server with the full privileges of the Jenkins process, which typically runs with elevated permissions. Successful exploitation compromises the confidentiality of all secrets stored in Jenkins including credentials, API keys, and deployment tokens. The integrity of the entire CI/CD pipeline is undermined as attackers can modify build artifacts, inject malicious code into deployments, and tamper with build results. The availability of the Jenkins infrastructure can be disrupted through denial of service or destruction of build configurations. The EPSS percentile of approximately 99.7% places this vulnerability among the most actively exploited Jenkins flaws, reflecting its high value to attackers targeting software supply chains.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-1003029 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 99.7% indicates near-certain exploitation activity, making this one of the most exploited Jenkins vulnerabilities. Sandbox bypass vulnerabilities in the Jenkins Script Security Plugin are highly valued by attackers because they provide direct code execution on CI/CD infrastructure, offering access to source code, build pipelines, deployment credentials, and production environments. The availability of mature exploitation techniques and the widespread deployment of Jenkins in enterprise environments make CVE-2019-1003029 an extremely high-priority threat.
Remediation
-
Update the Jenkins Script Security Plugin immediately as directed by CISA: "Apply updates per vendor instructions." Upgrade to a version of the Script Security Plugin that addresses the sandbox bypass vulnerability. Verify the plugin version on all Jenkins instances in your environment.
-
Restrict pipeline script permissions by implementing the principle of least privilege for Jenkins users. Limit who can create, modify, or approve pipeline scripts using Jenkins' authorization strategies such as Matrix-based Security or Role-Based Access Control (RBAC). Ensure only trusted administrators can approve Groovy sandbox exceptions.
-
Enable script approval workflows by configuring the Script Security Plugin to require administrator approval for all scripts that request sandbox exceptions. Review and audit all pending and approved script approvals to identify any previously exploited sandbox bypasses.
-
Monitor Jenkins for indicators of compromise by reviewing Jenkins system logs for unusual script execution events, unexpected process creation on the Jenkins master, and signs of credential access or exfiltration. Deploy monitoring for Jenkins-specific attack patterns including sandbox escape attempts.
-
Isolate the Jenkins master server from production environments and sensitive infrastructure. Run Jenkins master with minimal operating system privileges, implement network segmentation between Jenkins and production systems, and use ephemeral build agents to limit the impact of compromise on the Jenkins infrastructure.
Technical Details
CVE-2019-1003029 is a protection mechanism failure (CWE-693) in the Jenkins Script Security Plugin that allows attackers to bypass the Groovy sandbox designed to restrict script execution capabilities. The Groovy sandbox works by intercepting method calls, property access, and other operations at runtime, checking them against a whitelist of approved operations before allowing execution. The vulnerability involves a flaw in the sandbox's interception mechanism that allows an attacker to craft specific Groovy expressions or class definitions that evade the sandbox's runtime checks, enabling direct access to Java APIs and operating system functionality that should be blocked. This sandbox bypass can be triggered by any user with permission to define or configure Jenkins pipeline scripts, and it executes with the full privileges of the Jenkins master process, which typically has access to all credentials, build configurations, and connected systems.
Frequently Asked Questions
Is CVE-2019-1003029 being actively exploited?
Yes, CVE-2019-1003029 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 99.7% confirms this is one of the most actively exploited Jenkins vulnerabilities.
What products are affected by CVE-2019-1003029?
CVE-2019-1003029 affects the Jenkins Script Security Plugin, which is used across Jenkins installations to sandbox Groovy script execution in pipeline definitions. Any Jenkins instance running a vulnerable version of the Script Security Plugin is at risk.
How do I fix CVE-2019-1003029?
Update the Jenkins Script Security Plugin to the latest patched version. Restrict pipeline script permissions to trusted administrators only, enable script approval workflows, and monitor Jenkins for indicators of compromise or unauthorized script execution.
How severe is CVE-2019-1003029?
CVE-2019-1003029 is an extremely severe vulnerability with an EPSS percentile of approximately 99.7%. The sandbox bypass allows arbitrary code execution on the Jenkins master server, providing access to all credentials, build pipelines, and deployment infrastructure, making it a critical threat to software supply chain security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.