Jenkins Stapler + Script Security Pre-Auth RCE (Orange Tsai)

aka Hacking Jenkins Part 2

Product: Jenkins Jenkins core / Script Security plugin
CVE: CVE-2018-1000861 CVE-2019-1003000 CVE-2019-1003001 CVE-2019-1003002
Disclosed: 2019-01-08
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Jenkins <= 2.153, LTS <= 2.138.3; Script Security <= 1.49
Fixed: Jenkins 2.154, LTS 2.138.4; Script Security 1.50

Summary

Orange Tsai chained a Stapler URL-routing flaw that reaches methods via unauthenticated paths with a Groovy sandbox bypass in the Script Security plugin's checkScript endpoint. A single GET request compiling a Groovy class with a malicious constructor or @Grab annotation yields code execution.

Root cause

Stapler maps URL segments to getter/do* methods on Java objects, so /securityRealm/user/<x>/descriptorByName/... reaches SecureGroovyScript's doCheckScript without the usual permission checks (CVE-2018-1000861). The 'check' only parses/compiles the script, but compile-time AST transforms (@ASTTest, @Grab) and class initializers run code outside the sandbox (CVE-2019-1003000/1/2).

Impact

Unauthenticated RCE on Jenkins instances where anonymous users have Overall/Read (common) or via the ACL bypass.

Public PoC

http://target:8080/securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript
?sandbox=true
&value=public class x {
  public x(){
    "touch /tmp/success".execute()
  }
}

Source: vulhub / jenkins/CVE-2018-1000861

Detection

Search logs for '/descriptorByName/org.jenkinsci.plugins.scriptsecurity' or 'checkScript' with 'value=' parameters. nuclei template CVE-2018-1000861.

Mitigation

Upgrade Jenkins core and Script Security / Pipeline plugins; disable anonymous read.