CVE-2022-43403

Vulnerability

Overview

CVE-2022-43403 is a sandbox bypass vulnerability in Jenkins Script Security Plugin versions 1183.v774b_0b_0a_a_451 and earlier. The root cause is that the plugin does not intercept implicit casts performed by the Groovy language runtime when an array-like value is cast to an array type. This includes casts during method return values, local variable assignments, field/property assignments, and default value definitions [1][4].

Exploitation

An attacker must have permission to define and run sandboxed scripts, such as Pipeline scripts. The sandbox is designed to restrict such users to safe operations, but this flaw allows bypassing those restrictions. The cast operation is not part of the plugin's allowlist checks, so the sandbox fails to block the unsafe cast [1][3].

Impact

Successful exploitation enables arbitrary code execution in the context of the Jenkins controller JVM. This could lead to full compromise of the Jenkins instance, including access to credentials, builds, and other sensitive data [1][4]. The vulnerability has a base CVSS score of 9.9 (Critical) [2].

Mitigation

Jenkins has released Script Security Plugin version 1184.v85d16b_d851b_3 and Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773 to address this issue. Users should upgrade immediately. No workaround is available if the plugin is in use [1][3].