CVE-2019-1003030

Jenkins Pipeline Groovy is used to automate builds and deployments with scripts. This bug lets a malicious script escape the “sandbox” that’s supposed to limit what the script can do, so the attacker can run commands on the main Jenkins server. In practice, that can turn CI/CD automation into a control panel for attackers.

This matters if you use Jenkins Pipeline: Groovy Plugin (workflow-cps) in a Jenkins setup (including Jenkins Pipeline Groovy in Red Hat OpenShift environments that include it). It’s a network-reachable issue in normal setups, but it only becomes a real risk when an attacker can influence Pipeline scripts (for example, by getting access to add/modify pipeline definitions). If an attacker cannot control pipeline scripts, impact is much less direct.

This should be treated as urgent because it is listed in the CISA Known Exploited Vulnerabilities (KEV), meaning it has been exploited in the real world. Attackers can bypass the Groovy sandbox when they can control pipeline scripts, which can lead to direct command execution on your Jenkins server—so you should prioritize patching now.

1. Confirm exposure (plugin version)

   • In Jenkins, go to the plugin list and locate “workflow-cps” (Jenkins Pipeline: Groovy Plugin).
   • If the installed version is 2.63 or earlier, you are affected.

2. Confirm where scripts can be changed (the key precondition)

   • Identify users/roles and any integrations that can create or modify Jenkins Pipeline Groovy scripts (Jenkinsfile and any referenced shared libraries).
   • Check whether pipeline definitions are automatically pulled from a repository; ensure only trusted branches/repos can update them.

3. Patch to the fixed version

   • Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to 2.64 or later.
   • After upgrade, re-check the installed workflow-cps version in Jenkins to confirm it’s no longer 2.63 or earlier.

4. If patching is delayed (temporary containment while you work)

   • Immediately restrict who/what can edit pipeline scripts and Jenkinsfiles.
   • Disable or quarantine pipelines that come from untrusted sources until you have upgraded.
   • Remove/lock down credentials or service accounts used by pipelines that are sourced from less-trusted systems.

5. KEV timeline and expectations

   • CISA KEV remediation due date: 2022-04-15.
   • Because KEV indicates real exploitation, aim to be beyond the fixed version before making further environment changes.

6. What to monitor after updating

   • Jenkins activity: any changes to pipeline definitions, shared libraries, and credentials used by pipelines.
   • Unexpected build steps or “new” commands appearing in pipeline logs.
   • System behavior on the Jenkins host consistent with unauthorized command execution (for example, unusual processes started by Jenkins).

Severity and type: This is a critical sandbox bypass (CWE-693) in Jenkins Pipeline: Groovy Plugin (workflow-cps) where Groovy Plugin 2.63 and earlier can be abused to execute arbitrary code on the Jenkins master JVM.

Mechanism (how it’s triggered): An attacker who can control Jenkins Pipeline Groovy scripts can bypass Groovy sandbox restrictions and run arbitrary code on the server. The findings state authentication required is low and the flaw is reachable in default configuration, but the practical gate is script control.

Exploitation status: Confirmed in CISA KEV (listed 2022-03-25), with an action/remediation due date of 2022-04-15. A public exploit is available, indicating mature exploitation capability.

Patch: workflow-cps is fixed in 2.64 (upgrade org.jenkins-ci.plugins.workflow:workflow-cps to >= 2.64).

EPSS: A very high predicted likelihood was reported, but because exploitation is confirmed via KEV, the KEV status should be treated as the primary signal for urgency.

Operational note: The impact can extend beyond “just builds” because attackers executing on the Jenkins master can potentially tamper with CI/CD actions, access stored secrets, and disrupt operations.