GHSA-76qj-9gwh-pvv3

Sandbox bypass in Jenkins Script Security Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2023-24422

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:script-security	< 1229.v4880b	1229.v4880b

Details

As written in the advisory (Markdown source, shown as plain text).

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-24422 advisory
https://github.com/jenkinsci/script-security-plugin/commit/4880bbe905a6783d80150c8b881d0127430d4a73 web
https://github.com/jenkinsci/script-security-plugin package
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016 web