CVE-2022-43404

Vulnerability

CVE-2022-43404 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin version 1183.v774b_0b_0a_a_451 and earlier. The flaw arises because the plugin fails to properly intercept casts performed implicitly by the Groovy language runtime when returning values from methods or assigning local variables, fields, and properties. Attackers can craft constructor bodies and call sandbox-generated synthetic constructors to escape the sandbox restrictions [1][3].

Exploitation

To exploit this vulnerability, an attacker must have permission to define and run sandboxed scripts, including Pipelines, within a Jenkins instance. No additional authentication or network position is required beyond that permission. The attack leverages the gap between the sandbox's allowlist checks and the Groovy runtime's implicit casts, allowing malicious code to execute outside the sandbox [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the Jenkins controller JVM. This can lead to full compromise of the Jenkins server, including access to credentials, builds, and secrets. The vulnerability is rated High severity (CVSS score not explicitly provided but implied) [1][3].

Mitigation

Jenkins has released updates for the Script Security Plugin to address this issue. Users should upgrade to a version beyond 1183.v774b_0b_0a_a_451. The advisory also notes that similar vulnerabilities were fixed in Pipeline: Groovy Plugin and other components [1][2].