Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-1003006

CVE-2019-1003006: Jenkins Groovy Plugin sandbox bypass vulnerability

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-1003006
GHSA ID
GHSA-xfwj-2f34-32f5
EPSS Score
0.19009%
CWE
CWE-862
Published
5/13/2022
Updated
12/30/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:groovymaven<= 2.02.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the script validation endpoint in StringScriptSource.java using an insecure Groovy compiler configuration. The commit 212e048 shows the fix involved adding GroovySandbox.createSecureCompilerConfiguration() to the GroovyShell instantiation in doCheckScript. This method was vulnerable because it allowed parsing user-supplied Groovy scripts with dangerous AST annotations enabled, which could execute arbitrary code. The test cases added in the commit verify blocking of @ASTTest and @Grab annotations, confirming this was the attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* s*n**ox *yp*ss vuln*r**ility *xists in J*nkins *roovy Plu*in *.* *n* **rli*r in `sr*/m*in/j*v*/*u*son/plu*ins/*roovy/Strin*S*riptSour**.j*v*` t**t *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to provi** * *roovy s*ript to *n *TTP *n*point t**t **n

Reasoning

T** vuln*r**ility st*ms *rom t** s*ript `v*li**tion` *n*point in `Strin*S*riptSour**.j*v*` usin* *n ins**ur* *roovy *ompil*r `*on*i*ur*tion`. T** *ommit `*******` s*ows t** *ix involv** ***in* `*roovyS*n**ox.*r**t*S**ur**ompil*r*on*i*ur*tion()` to t*