Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jenkinsci/script-security-plugin

              master @ a5f0130
            

105

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Sandbox Escape: 82 prior fixes. Scrutinize any change in this area.

src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptor.java: most-fixed (22 issues). Treat as high-risk during review.

88 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Attackers regularly bypassed sandbox compilation filters by nesting malicious Groovy AST transformations (like @ASTTest or @Grab) inside other annotations, or utilizing alias imports to evade the customized compiler checks. Strict canonicalization and comprehensive recursive annotation visitation are necessary to prevent compile-time arbitrary code execution.

Sandbox Escape: Groovy's complex dispatch model offers multiple bypass vectors—including custom property getters/setters (isProp/getProp), map constructor shadowing, array indexing, and MetaClass dynamic closure injections. The interceptor must consistently intercept all fallback paths and evaluate them against the active whitelist before execution.

Sandbox Escape: Deficiencies in matching dynamic types (such as GString conversions, null arguments in varargs, primitive widening, and array trailing parameters) frequently allowed sandboxed code to bypass specific method-signature whitelists by triggering mismatched overload resolution.