CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
Description
CVE-2019-1003030 is a sandbox bypass vulnerability in the Jenkins Matrix Project Plugin that allows attackers to escape the Groovy sandbox and execute arbitrary code on the Jenkins controller. An authenticated user with Job/Configure permissions can exploit this flaw by crafting a malicious Groovy script that bypasses the Script Security sandbox restrictions. Jenkins is one of the most widely used CI/CD automation servers, making this a significant supply chain risk. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, with an EPSS score of 2.5% (90.4th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jenkins | pipeline\ | <= 2.63 |
| redhat | openshift container platform | 3.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/159603/Jenkins-2.63-Sandbox-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/107476(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2019:0739(Third Party Advisory)
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20%282%29(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1003030(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2019-1003030 is classified under CWE-94, which describes vulnerabilities where an application does not properly control the generation or execution of code. The Jenkins Matrix Project Plugin fails to properly enforce the Groovy sandbox restrictions, allowing specially crafted scripts to bypass security controls and execute arbitrary code on the Jenkins controller.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2019-1003030 allows authenticated Jenkins users with Job/Configure permissions to bypass the Groovy sandbox and execute arbitrary code on the Jenkins controller with full system privileges. The Jenkins controller typically has access to all build secrets, credentials, and deployment keys stored in the Jenkins credential store, SSH keys and API tokens for connected systems, source code repositories and build artifacts, and production deployment pipelines and infrastructure. Compromise of the Jenkins controller represents a critical supply chain risk, as attackers can inject malicious code into software builds, steal deployment credentials, and pivot to production systems. The EPSS score of 2.5% reflects the authentication requirement, but the impact of successful exploitation is severe.
Exploit Maturity
CVE-2019-1003030 has been confirmed as actively exploited by CISA. While the EPSS score of 2.5% (90.4th percentile) is lower than many other KEV entries due to the authentication requirement, the vulnerability is well-documented and the Groovy sandbox bypass technique is understood by security researchers. The critical nature of Jenkins infrastructure and the availability of detailed technical information make this vulnerability a priority target for attackers who have gained initial access to a Jenkins environment.
Remediation
- Update the Matrix Project Plugin: Upgrade the Jenkins Matrix Project Plugin to the latest version that addresses CVE-2019-1003030.
- Review and restrict user permissions: Audit Jenkins user accounts and restrict Job/Configure permissions to only those users who absolutely require them.
- Enable Script Approval: Ensure the Script Security plugin is properly configured and that all scripts require administrator approval before execution.
- Monitor Jenkins audit logs: Review Jenkins audit logs for suspicious script executions, job configuration changes, and credential access events.
- Isolate the Jenkins controller: Ensure the Jenkins controller runs in a network segment with restricted access and does not have direct connectivity to production systems.
Technical Details
CVE-2019-1003030 is a Groovy sandbox bypass vulnerability in the Jenkins Matrix Project Plugin. Jenkins uses a Groovy sandbox to restrict the operations that user-defined scripts can perform, preventing them from executing arbitrary system commands or accessing sensitive Java APIs. The Matrix Project Plugin processes Groovy expressions for configuring build matrices, and the vulnerability exists because the plugin does not properly apply sandbox restrictions to all code paths. An authenticated user with Job/Configure permissions can craft a Groovy expression that exploits this gap to escape the sandbox and execute arbitrary Java code on the Jenkins controller JVM, effectively gaining full control of the Jenkins server.
Frequently Asked Questions
Is CVE-2019-1003030 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2019-1003030. While authentication is required, attackers who gain initial access to Jenkins environments actively target sandbox bypass vulnerabilities to escalate privileges.
What products are affected by CVE-2019-1003030?
CVE-2019-1003030 affects the Jenkins Matrix Project Plugin. Jenkins is an open-source CI/CD automation server widely used in software development and deployment pipelines.
How do I fix CVE-2019-1003030?
Update the Matrix Project Plugin to the latest patched version. Additionally, restrict Job/Configure permissions, enable script approval workflows, and monitor Jenkins audit logs for suspicious activity.
How severe is CVE-2019-1003030?
CVE-2019-1003030 is a significant vulnerability that enables sandbox escape and arbitrary code execution on the Jenkins controller. Due to Jenkins' central role in CI/CD pipelines, compromise can lead to supply chain attacks affecting all software built and deployed through the compromised instance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.