Sandbox Bypass Vulnerability in Jenkins Script Security Plugin Allows Arbitrary Code Execution
CVE-2024-34144

Currently unrated

Key Information:

Vendor
Jenkins
Status
Jenkins Script Security Plugin
Vendor
CVE Published:
2 May 2024

Badges

👾 Exploit Exists

Summary

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected Version(s)

Jenkins Script Security Plugin 0 <= 1335.vf07d9ce377a_e

References

https://www.jenkins.io/security/advisory/2024-05-02/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/05/02/3

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database0 Proof of Concept(s)
.