CVE-2017-1000096 Arbitrary code execution due to incomplete sandbox protection in Jenkins Pipeline

What is CVE-2017-1000096?

CVE-2017-1000096 is a high-severity code injection vulnerability in n/a, published on 4 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

Weakness: CWE-732

Which versions are affected by CVE-2017-1000096?

2 open source packages ship an affected version, including org.jenkins-ci.plugins.workflow:workflow-cps. It affects 1 product.

Products include Jenkins Pipeline\.

How do I fix CVE-2017-1000096?

Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to 2.36.1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-1000096 being exploited?

There is no known exploitation of CVE-2017-1000096 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-1003030 Jenkins Matrix Project Plugin Remote Code Execution Exploited Critical 9.9
• CVE-2022-43402 Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution Critical 9.9
• CVE-2019-1003041 Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin Critical 9.8
• CVE-2022-43407 CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin High 8.8
• CVE-2022-25173 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mhwq-4mh7-fv7c.