The Jenkins Script Security Plugin contains a critical sandbox bypass vulnerability that allows authenticated attackers to achieve arbitrary code execution on the Jenkins controller.

This vulnerability arises from improper collection casting during sandboxed Groovy script execution, which allows an attacker with permission to define or run scripts to circumvent sandbox protections. The attacker must possess the ability to run sandboxed scripts, such as Pipelines, to trigger this flaw.

Successful exploitation allows an attacker to execute arbitrary code within the Jenkins controller JVM, effectively granting them full control over the Jenkins instance. Given the high CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of the build infrastructure, potentially leading to supply chain compromise or unauthorized access to sensitive credentials stored within Jenkins.

Immediate Action: Review the official Jenkins security advisory and update the Script Security Plugin to the latest available version once released.

Proactive Monitoring: Monitor Jenkins build logs and audit trails for suspicious script execution patterns or unauthorized attempts to access restricted Java classes and methods.

Compensating Controls: Restrict permissions regarding who is authorized to define or execute custom scripts or Pipelines within the Jenkins environment to minimize the attack surface.

Public Exploit Available: Unknown

This vulnerability poses a high risk to the security of the CI/CD pipeline. Administrators should prioritize identifying and restricting users with script execution capabilities while awaiting the official patch from Jenkins. Applying the update as soon as it is released is essential to preventing potential unauthorized code execution on the Jenkins controller.