CVE-2022-30945
📋 TL;DR
This vulnerability in Jenkins Pipeline: Groovy Plugin allows attackers in sandboxed pipelines to load arbitrary Groovy source files from the Jenkins classpath, bypassing sandbox restrictions. It affects Jenkins instances with the vulnerable plugin version, potentially enabling remote code execution. Users of Jenkins with Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier are affected.
💻 Affected Systems
- Jenkins Pipeline: Groovy Plugin
📦 What is this software?
Pipeline\ by Jenkins
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on the Jenkins controller, allowing complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized code execution within Jenkins pipelines, enabling privilege escalation, credential theft, and manipulation of Jenkins jobs and configurations.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are implemented, though sandbox bypass remains possible.
🎯 Exploit Status
Exploitation requires some Jenkins pipeline access. Proof-of-concept code is publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2689.v434009a_31b_f2 and later
Vendor Advisory: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
Restart Required: Yes
Instructions:
1. Update Jenkins Pipeline: Groovy Plugin to version 2689.v434009a_31b_f2 or later via Jenkins Plugin Manager. 2. Restart Jenkins to apply the update.
🔧 Temporary Workarounds
Disable Groovy Sandbox
allDisable the Groovy sandbox feature in Jenkins, though this reduces security for legitimate pipelines.
Navigate to Jenkins > Manage Jenkins > In-process Script Approval > Configure and disable sandbox
🧯 If You Can't Patch
- Restrict pipeline creation and execution to trusted users only.
- Implement network segmentation to isolate Jenkins from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check Jenkins plugin version: Navigate to Manage Jenkins > Manage Plugins > Installed tab, find 'Pipeline: Groovy Plugin' and verify version is 2689.v434009a_31b_f1 or earlier.Check Version:
On Jenkins web interface: Manage Jenkins > Manage Plugins > Installed tabVerify Fix Applied:
Confirm plugin version is 2689.v434009a_31b_f2 or later in the Installed plugins list after update.📡 Detection & Monitoring
Log Indicators:
- Unusual Groovy file loading in pipeline logs
- Suspicious pipeline executions from untrusted users
Network Indicators:
- Unexpected outbound connections from Jenkins controller
SIEM Query:
source="jenkins.log" AND ("Groovy" AND "sandbox" AND "bypass")