Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin
Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection.
In Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier, any Groovy source files bundled with Jenkins core and plugins could be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed.
The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.
Pipeline: Groovy Plugin 2692.v76b_089ccd026 restricts which Groovy source files can be loaded in Pipelines.
Groovy source files in public plugins intended to be executed in sandboxed pipelines have been identified and added to an allowlist. The new extension point org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist allows plugins to add specific Groovy source files to that allowlist if necessary, but creation of plugin-specific Pipeline DSLs is strongly discouraged.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jenkins-ci.plugins.workflow:workflow-cps | < 2692.v76b | 2692.v76b |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2022-30945
- https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db
- https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2
- https://github.com/jenkinsci/workflow-cps-plugin
- https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
- http://www.openwall.com/lists/oss-security/2022/05/17/8
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-434, CWE-552- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.jenkins-ci.plugins.workflow:workflow-cps- Publicada
- 18.05.2022
- Actualizado
- 11.10.2026 11:21
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-2xvx-rw9p-xgfc - CC BY 4.0
Historial de vulnerabilidades: org.jenkins-ci.plugins.workflow:workflow-cps
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 13
- Primera → última
- 02.2022 11.2024
- Sin corrección
- 0
- Explotada en ataques
- 1
Distribución por gravedad
- Crítica 3
- Alta 8
- Media 2
Divulgaciones por año
- 2022: 12
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.