CVE-2019-1003029

What is the Jenkins Script Security Plugin?

Jenkins is one of the most widely deployed open-source automation servers, orchestrating build, test, and deployment pipelines across countless organizations. The Script Security Plugin provides the "sandbox" that Jenkins uses to let users write Groovy scripts (for Pipeline jobs and other scripted configuration) while attempting to restrict which Java/Groovy APIs those scripts can call — a critical control since Jenkins controllers routinely hold credentials, deployment keys, and access to production infrastructure.

Overview

CVE-2019-1003029 is a Critical (9.9) sandbox-bypass vulnerability in the Script Security Plugin. A user with permission to configure jobs — even one who is only supposed to have limited scripting ability inside the sandbox — could craft Groovy code that escapes the sandbox's restrictions and executes arbitrary code on the Jenkins controller with full trust, rather than being confined to the sandboxed API allowlist. Jenkins fixed the issue in Script Security Plugin 1.53, released alongside a broader set of related sandbox-bypass fixes in March 2019.

Technical Details

The vulnerability is a protection-mechanism failure in the sandbox's static type-checking and method-interception logic, which failed to fully cover certain Groovy language constructs an attacker could use to reach unsandboxed code paths. Because Jenkins' scope in CVSS is "Changed" — the vulnerable component (the sandbox) is a security boundary whose failure impacts something outside its own scope, namely the underlying Jenkins controller — a successful bypass grants full read/write/execute access to the Jenkins controller itself, including stored credentials and connected infrastructure, from an attacker who only needed low-privilege job-configuration rights.

Discovery

Addressed through Jenkins' security team and community vulnerability-reporting process (Jenkins runs an ongoing bug bounty program), as part of a coordinated set of sandbox-related plugin fixes released together in March 2019.

Exploitation Context

CISA's KEV catalog confirms this vulnerability has been exploited in the wild. Because Jenkins controllers frequently hold credentials for source repositories, cloud infrastructure, and deployment targets, a successful sandbox bypass is an attractive target for attackers seeking to pivot from a compromised or malicious CI job into broader infrastructure compromise — a pattern widely reported by the DevSecOps community as internet-facing Jenkins instances became a common initial-access and supply-chain-attack target throughout 2019–2022.

Remediation

1. Upgrade Script Security Plugin to 1.53 or later immediately.
2. Audit and restrict who can configure Jenkins jobs, since sandbox-bypass exploitation requires job-configuration permissions.
3. Avoid exposing Jenkins controllers directly to the internet; place them behind authentication and network access controls.
4. Rotate any credentials stored in Jenkins if the instance was unpatched and internet-reachable during the exposure window.
5. Enable Jenkins' audit logging and review job configuration history for unauthorized or unexpected script changes.