CVE-2024-34144: Script security Jenkins Script Security Plugin Has Vulnerability
HIGHCVE-2024-34144 is a HIGH (CVSS 8.8) jenkins script security plugin has vulnerability (CWE-693: Protection Mechanism Failure) affecting Script security libraries in the Maven ecosystem. The issue involves jenkins script security plugin has sandbox bypass vulnerability involving crafted constructor bodies. Remediation is available by upgrading affected packages to version 1336.vf33a.
CVE-2024-34144 at a Glance
Security Impact
CVSS: 8.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2024-34144
To remediate this vulnerability, upgrade all affected Script security dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>org.jenkins-ci.plugins</groupId>
<artifactId>script-security</artifactId>
<version>1336.vf33a</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=org.jenkins-ci.pluginsHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2024-34144, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=org.jenkins-ci.pluginsAnalyze the terminal output to locate any version of Script security in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1336.vf33a), your application is affected.
Note: The mvn dependency:tree -Dincludes=org.jenkins-ci.plugins command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-693: Protection Mechanism Failure, where the product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. In Script security, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-34144 Affected Script security Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
org.jenkins-ci.plugins:script-security
|
Maven |
< 1336.vf33a
|
1336.vf33a
|
References
Frequently Asked Questions
What is CVE-2024-34144?
Which Script security versions are affected?
What version fixes CVE-2024-34144?
Is script-security affected?
What is the CVSS score of CVE-2024-34144?
What CWE is associated with CVE-2024-34144?
How can I check Maven dependencies for CVE-2024-34144?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-v63g-v339-2673",
"modified" : "2024-07-03T20:09:30Z",
"published" : "2024-05-02T15:30:35Z",
"aliases" : [ "CVE-2024-34144" ],
"summary" : "Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies",
"details" : "Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.\n\nMultiple sandbox bypass vulnerabilities exist in Script Security Plugin 1335.vf07d9ce377a_e and earlier:\n\n- Crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.\n\n- Sandbox-defined Groovy classes that shadow specific non-sandbox-defined classes can be used to construct any subclassable type.\n\nThese vulnerabilities allow attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.\n\n- These issues are caused by an incomplete fix of [SECURITY-2824](https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20(1)).\n\nScript Security Plugin 1336.vf33a_a_9863911 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox:\n\n- Calls to to other constructors using this are now intercepted by the sandbox.\n\n- Classes in packages that can be shadowed by Groovy-defined classes are no longer ignored by the sandbox when intercepting super constructor calls.\n\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "org.jenkins-ci.plugins:script-security"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1336.vf33a"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-34144"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jenkinsci/script-security-plugin"
}, {
"type" : "WEB",
"url" : "https://github.com/jenkinsci/script-security-plugin/releases/tag/1336.vf33a_a_9863911"
}, {
"type" : "WEB",
"url" : "https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2024/05/02/3"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-693" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-05-03T20:14:29Z",
"nvd_published_at" : "2024-05-02T14:15:10Z"
}
}