CVE-2024-34145

Vulnerability

Overview

The Jenkins Script Security Plugin provides a sandbox feature to safely execute low-privilege scripts, including Pipelines. A sandbox bypass vulnerability exists in versions 1335.vf07d9ce377a_e and earlier, where Groovy classes defined inside the sandbox can shadow specific non-sandbox-defined classes [1]. By creating a sandbox-defined class that shadows a class outside the sandbox, an attacker can circumvent the sandbox interceptor and instantiate arbitrary subclassable types, breaking the protection boundaries.

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have permission to define and run sandboxed scripts, which is typically granted to users with Job/Configure or similar privileges in Jenkins [3]. The attack leverages crafted Groovy code that defines a class with the same fully qualified name as a non-sandbox class, effectively taking advantage of the sandbox's insufficient filtering of shadowed classes [2]. No additional network access or authentication bypass is required beyond the initial script execution capability.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the Jenkins controller JVM [1]. This can lead to full compromise of the Jenkins controller, including access to secrets, credentials, and the ability to manipulate builds, jobs, and configurations. The vulnerability is rated High severity due to the potential for complete system takeover [3].

Mitigation

Jenkins released Script Security Plugin version 1336.vf33a_a_9863911, which adds additional restrictions and sanity checks to prevent super constructor calls and ensures that classes in shadowable packages are no longer ignored by the sandbox [3]. Users should upgrade to this version or later immediately. There are no known workarounds for this vulnerability.