CVE-2022-43405

Vulnerability

Overview

CVE-2022-43405 is a sandbox bypass vulnerability in the Jenkins Pipeline: Groovy Libraries Plugin, affecting versions 612.v84da_9c54906d and earlier. The root cause lies in the plugin's insufficient sandbox enforcement: the Groovy language runtime performs implicit casts (e.g., when returning values from methods or assigning variables) that are not intercepted by the sandbox allowlist checks. This allows attackers to craft scripts that escape the sandbox constraints normally applied to untrusted Pipeline libraries. [1]

Exploitation

Prerequisites and Attack Vector

To exploit this vulnerability, an attacker must have permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, within the Jenkins environment. No additional elevated privileges are required beyond these standard configuration permissions. The attack surface is the Jenkins controller's Groovy script execution engine, where malicious code is introduced via a specially crafted Pipeline library. The sandbox runs scripts in a restricted context, but the implicit cast flaw enables the attacker to break out of that context. [1][2]

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the Jenkins controller JVM, completely bypassing the sandbox protections designed to prevent such actions. This can lead to full compromise of the Jenkins controller, including access to all jobs, credentials, secrets, and the ability to further pivot within the network. [3]

Mitigation

Status

The vulnerability has been patched in Pipeline: Groovy Libraries Plugin version 613.v9c41a_160233f, as announced in the Jenkins Security Advisory 2022-10-19. Users are strongly advised to upgrade immediately. Jenkins also recommends reviewing and limiting the set of users who have permission to define untrusted libraries and run sandboxed scripts to reduce the risk of exploitation. No workarounds beyond the upgrade have been published. [1][2]