Bug 1471064 (CVE-2017-1000096)

Summary:	CVE-2017-1000096 jenkins-plugin-workflow-cps: Arbitrary code execution due to incomplete sandbox protection (SECURITY-551)
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ahardin, bleanhar, ccoleman, dedgar, dmcphers, eparis, jgoulding, jkeck, joelsmith, jokerman, kseifried, mchappel, tjay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins-plugin-workflow-cps 2.36.1	Doc Type:	If docs needed, set a value
Doc Text:	The jenkins-plugin-script-security has incomplete sandbox protection which allows attackers to execute arbitrary code via constructors, instance variable initializers, and instance initializers in Pipeline scripts. Exploitation of this requires the attacker to have permission to configure Pipelines in Jenkins or be a trusted committers to repositories containing Jenkinsfiles and for that Jenkins instance to be hosting other projects as well that the attacker should not have access to.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-14 16:43:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1472033
Bug Blocks:	1471067

Description Adam Mariš 2017-07-14 10:38:16 UTC

Pipelines are subject to script security: Either the entire Pipeline needs to be approved, or it runs in a sandbox, with only whitelisted methods etc. allowed to be called.

Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code.

This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.

External References:

https://jenkins.io/security/advisory/2017-07-10/

Comment 1 Adam Mariš 2017-07-14 10:38:33 UTC

Acknowledgments:

Name: the Jenkins project
Upstream: Simon St John, Green

Comment 3 Trevor Jay 2017-08-14 16:43:03 UTC

Statement:

This issue affects the versions of jenkins-plugin-workflow-cps  as shipped with Red Hat OpenShift Enterprise 3. However, this flaw is of low impact under the supported scenarios in OpenShift Enterprise 3. A future update may address this issue.