GHSA-c9c2-wcxh-3w5j

Sandbox escape in Jenkins Email Extension Plugin

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-25765

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:email-ext	< 2.94	2.94

Details

As written in the advisory (Markdown source, shown as plain text).

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25765 advisory
https://github.com/jenkinsci/email-ext-plugin/commit/ffe44a4c1c1830325787d7ef5e9e19ebf9a936f9 web
https://github.com/jenkinsci/email-ext-plugin package
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-2939 web
http://www.openwall.com/lists/oss-security/2023/02/15/4 web