Vulnerabilities > CVE-2019-1003001

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000861
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003000
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003001
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003002
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003005
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003029
• https://jenkins.io/security/advisory/2019-01-08/
• https://blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html
• https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html
• https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc
• https://twitter.com/orange_8361/status/1126829648552312832
• https://github.com/orangetw/awesome-jenkins-rce-2019

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(129169);
  script_version("1.2");
  script_cvs_date("Date: 2019/09/25 17:12:07");

  script_cve_id("CVE-2019-1003000", "CVE-2019-1003001", "CVE-2019-1003002");
  script_bugtraq_id(106681);

  script_name(english:"Jenkins Security Advisory 2019-01-08 Multiple Vulnerabilities");
  script_summary(english:"Checks Jenkins Plugins versions.");

  script_set_attribute(attribute:"synopsis", value:
"A job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"Jenkins running on the remote web server has one or more plugins affected by following vulnerabilities:

  - A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in
    src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java
    that allows attackers with the ability to provide sandboxed scripts to execute arbitrary
    code on the Jenkins master JVM.
    (CVE-2019-1003000)

  - A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in
    src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java,
    src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java
    that allows attackers with Overall/Read permission to provide a pipeline script to an
    HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
    (CVE-2019-1003001)

  - A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in
    pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy
    that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP
    endpoint that can result in arbitrary code execution on the Jenkins master JVM.
    (CVE-2019-1003002)");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2019-01-08/");
  script_set_attribute(attribute:"solution", value:"Refer to vendor advisory for details.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1003000");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Jenkins ACL Bypass and Metaprogramming RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin");
  script_require_keys("www/Jenkins");

  exit(0);
}

include('audit.inc');
include('global_settings.inc');
include('misc_func.inc');
include('install_func.inc');


# list of plugins long names and their fixed versions
plugins = make_array(
'Pipeline: Declarative', '1.3.4.1',
'Pipeline: Groovy', '2.61.1',
'Script Security Plugin', '1.50'
);

app = 'Jenkins';
get_install_count(app_name:app, exit_if_zero:TRUE);

# Check if jenkins_plugins table exists
table = query_scratchpad("SELECT name FROM sqlite_master where type = 'table' and name = 'jenkins_plugins'");
if (empty_or_null(table)) exit(0, 'Unable to obtain jenkins_plugins table.');

report = '';
foreach longName (keys(plugins))
{
  res = query_scratchpad("SELECT version FROM jenkins_plugins WHERE longName = '" + longName +"';");
  if (empty_or_null(res)) continue;
  if(ver_compare(ver:res[0]['version'], fix:plugins[longName]) < 0)
  {
    report += '\nName: ' + longName;
    report += '\nVersion: ' + res[0]['version'];
    report += '\nFix: ' + plugins[longName];
  }
}

if (empty_or_null(report)) exit(0, 'There are no vulnerable versions of Jenkins plugins installed.');

security_report_v4(severity:SECURITY_WARNING, extra:report, port:0);

• rhsa	id RHBA-2019:0326

• rhsa	id RHBA-2019:0327

• atomic-enterprise-service-catalog-1:3.11.82-1.git.1673.133961e.el7
• atomic-enterprise-service-catalog-svcat-1:3.11.82-1.git.1673.133961e.el7
• atomic-openshift-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-clients-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-clients-redistributable-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-cluster-autoscaler-0:3.11.82-1.git.0.efb6af0.el7
• atomic-openshift-descheduler-0:3.11.82-1.git.300.89765c9.el7
• atomic-openshift-docker-excluder-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-dockerregistry-0:3.11.82-1.git.452.0ce6383.el7
• atomic-openshift-excluder-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-hyperkube-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-hypershift-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-master-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-metrics-server-0:3.11.82-1.git.52.2fdca3f.el7
• atomic-openshift-node-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-node-problem-detector-0:3.11.82-1.git.254.a448936.el7
• atomic-openshift-pod-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-sdn-ovs-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-service-idler-0:3.11.82-1.git.14.e353758.el7
• atomic-openshift-template-service-broker-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-tests-0:3.11.82-1.git.0.08bc31b.el7
• atomic-openshift-web-console-0:3.11.82-1.git.355.5e8b1d9.el7
• golang-github-openshift-oauth-proxy-0:3.11.82-1.git.425.7cac034.el7
• haproxy-debuginfo-0:1.8.17-3.el7
• haproxy18-0:1.8.17-3.el7
• jenkins-0:2.150.2.1549032159-1.el7
• jenkins-2-plugins-0:3.11.1549642489-1.el7
• openshift-ansible-0:3.11.82-3.git.0.9718d0a.el7
• openshift-ansible-docs-0:3.11.82-3.git.0.9718d0a.el7
• openshift-ansible-playbooks-0:3.11.82-3.git.0.9718d0a.el7
• openshift-ansible-roles-0:3.11.82-3.git.0.9718d0a.el7
• openshift-ansible-test-0:3.11.82-3.git.0.9718d0a.el7
• openshift-enterprise-autoheal-0:3.11.82-1.git.219.0b5aff4.el7
• openshift-enterprise-cluster-capacity-0:3.11.82-1.git.380.cf11c51.el7
• prometheus-0:3.11.82-1.git.5027.9d24833.el7
• prometheus-alertmanager-0:3.11.82-1.git.0.3bf41ce.el7
• prometheus-node-exporter-0:3.11.82-1.git.1063.48444e8.el7