CVE-2019-1003030

What is the Jenkins Matrix Project Plugin?

The Matrix Project Plugin extends Jenkins with "multi-configuration" jobs that run the same build across a matrix of axis combinations (different JDKs, operating systems, or build parameters). Like other Jenkins plugins that accept user-supplied configuration expressions, it interacts with the Script Security Plugin's Groovy sandbox to keep untrusted job configuration from reaching unrestricted code execution on the controller.

Overview

CVE-2019-1003030 is a Critical (9.9) vulnerability in the Matrix Project Plugin that allows a user with job-configuration permissions to escape the Groovy sandbox and achieve remote code execution on the Jenkins controller. It was fixed in Matrix Project Plugin 1.13, released as part of the same coordinated March 2019 Jenkins security advisory that addressed the related Script Security Plugin sandbox bypass (CVE-2019-1003029).

Technical Details

The vulnerability arises from insufficient sandbox protection in how the Matrix Project Plugin evaluates certain user-supplied configuration expressions used to define axis combinations, allowing crafted input to reach unsandboxed code execution rather than being confined to the restricted Groovy sandbox. As with other plugin sandbox-bypass CVEs from this advisory, the CVSS scope is "Changed" — the impact extends beyond the plugin itself to full compromise of the Jenkins controller, including any stored credentials and connected infrastructure.

Discovery

Addressed through Jenkins' security team and community vulnerability-reporting process, released as part of the coordinated March 2019 batch of sandbox-related plugin security fixes.

Exploitation Context

CISA's KEV catalog confirms this vulnerability has been exploited in the wild. Jenkins controllers are a high-value target because they typically hold source-control, cloud, and deployment credentials; sandbox-escape bugs in commonly installed plugins like Matrix Project have been leveraged by attackers to pivot from a low-privilege CI account into full infrastructure compromise, a pattern repeatedly observed against internet-exposed, unpatched Jenkins instances.

Remediation

1. Upgrade the Matrix Project Plugin to 1.13 or later immediately.
2. Apply the companion Script Security Plugin update (1.53 or later) at the same time, since the two fixes were released together and address related sandbox weaknesses.
3. Restrict job-configuration permissions to trusted users only.
4. Avoid exposing Jenkins controllers directly to the internet without strong authentication and network controls.
5. Rotate stored credentials if the instance was internet-reachable and unpatched during the disclosure window.