CVE-2022-43402

Vulnerability

Overview

CVE-2022-43402 is a sandbox bypass vulnerability in the Jenkins Pipeline: Groovy Plugin, affecting versions 2802.v5ea_628154b_c2 and earlier. The root cause is that the Groovy language runtime performs various implicit casts (e.g., when returning values from methods, assigning local variables, fields, or properties) that are not intercepted by the sandbox protection mechanism [1][3]. This allows sandboxed scripts to bypass the intended restrictions.

Exploitation

An attacker must have permission to define and run sandboxed scripts, including Pipelines, within Jenkins. By crafting a script that leverages these implicit casts, the attacker can circumvent the sandbox's allowlist checks and execute arbitrary code [1][2]. No additional authentication is required beyond the existing permissions for sandboxed script execution.

Impact

Successful exploitation enables arbitrary code execution in the context of the Jenkins controller JVM. This can lead to full compromise of the Jenkins server, including access to credentials, secrets, and the ability to modify jobs or infrastructure [1][3].

Mitigation

The vulnerability is fixed in Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773 and later. Users are strongly advised to upgrade immediately. No workarounds are available [2].