CVE-2019-1003032

Vulnerability

A sandbox bypass vulnerability exists in the Jenkins Email Extension Plugin version 2.64 and earlier [1][2][3]. The flaw is present in multiple source files including ExtendedEmailPublisher.java, EmailExtScript.java, ScriptContent.java, and AbstractScriptTrigger.java, allowing attackers with Job/Configure permission to escape the Groovy sandbox and execute arbitrary code on the Jenkins master JVM [2][3].

Exploitation

An attacker must have Job/Configure permission for a Jenkins project that uses the Email Extension Plugin [2]. The attacker can craft a malicious Groovy script within the email extension configuration (e.g., in script-based content or triggers). When the plugin evaluates this script, the sandbox protection is bypassed, leading to code execution on the master [2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Jenkins master JVM, potentially leading to full compromise of the Jenkins controller, disclosure of sensitive information, and the ability to perform further attacks on connected systems [2][3].

Mitigation

The vulnerability is fixed in Email Extension Plugin version 2.65, released on 2019-03-06 [2]. Users should upgrade immediately. There is no known workaround for versions 2.64 and earlier [2][3]. The plugin is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.