CVE-2022-43401

The Jenkins Script Security Plugin provides a sandbox feature that restricts scripts defined by low-privileged users. In versions 1183.v774b_0b_0a_a_451 and earlier, the sandbox does not intercept various casts performed implicitly by the Groovy language runtime. This includes casts when returning values from methods, assigning local variables, fields, or properties, and when defining default parameters [1][2].

Exploitation requires an attacker to have permission to define and run sandboxed scripts, including Jenkins Pipelines. No additional authentication is needed beyond these permissions. The attacker can craft a script that leverages these unguarded implicit casts to bypass the sandbox restrictions [3].

Successful exploitation allows arbitrary code execution in the context of the Jenkins controller JVM, potentially leading to full compromise of the Jenkins environment and access to sensitive data or other systems [1].

Jenkins has released Script Security Plugin version 1184.vb_b_c6b_0b_0a_b_a and Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773 that fix this vulnerability by properly intercepting implicit casts. Users are advised to update immediately [1][2].