Sandbox Bypass Vulnerability in Jenkins Script Security Plugin

CVE-2022-43403

Summary

A vulnerability exists in the Jenkins Script Security Plugin that allows attackers with sufficient permissions to exploit a flaw in the sandbox mechanism. By casting an array-like value to an array type, an attacker can bypass the sandbox security and execute arbitrary code within the Jenkins controller's Java Virtual Machine (JVM). This poses significant security risks for environments relying on Jenkins for CI/CD operations, potentially leading to unauthorized access and control over the system.

References