CVE-2017-1000095 Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin

What is CVE-2017-1000095?

CVE-2017-1000095 is a medium-severity vulnerability in n/a, published on 4 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild['rawBuild'] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).

Weakness: CWE-732

Which versions are affected by CVE-2017-1000095?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:script-security. It affects 1 product.

Products include Jenkins Script Security.

How do I fix CVE-2017-1000095?

Upgrade org.jenkins-ci.plugins:script-security to 1.29.1 or later.

Is CVE-2017-1000095 being exploited?

There is no known exploitation of CVE-2017-1000095 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-1003029 Jenkins Script Security Plugin Sandbox Bypass Exploited Critical 9.9
• CVE-2022-43401 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin Critical 9.9
• CVE-2022-43403 Jenkins Script Security Plugin sandbox bypass vulnerability Critical 9.9
• CVE-2022-43404 Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin Critical 9.9
• CVE-2020-2279 Sandbox bypass vulnerability in Jenkins Script Security Plugin Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m68x-cc2f-gr5h, RHEA-2017:1716.