CVE-2018-1000058 : Security Advisory and Response

The Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier have a vulnerability with incomplete sandbox protection, potentially leading to arbitrary code execution.

Understanding CVE-2018-1000058

What is CVE-2018-1000058?

The vulnerability in the Jenkins Pipeline: Supporting APIs Plugin allows for arbitrary code execution due to inadequate sandbox protection, specifically affecting methods related to Java deserialization.

The Impact of CVE-2018-1000058

The vulnerability enables malicious code execution through a sandbox protection loophole, exploitable by Jenkins users with Pipeline configuration permissions or trusted individuals with access to Jenkinsfiles.

Technical Details of CVE-2018-1000058

Vulnerability Description

The issue arises from incomplete sandbox protection in Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier, allowing for arbitrary code execution through Java deserialization methods like readResolve.

Affected Systems and Versions

Jenkins Pipeline: Supporting APIs Plugin versions 2.17 and earlier

Exploitation Mechanism

Malicious code can be executed by leveraging the vulnerability in methods related to Java deserialization, such as readResolve, which were not fully protected by the sandbox.

Mitigation and Prevention

Immediate Steps to Take

Update Jenkins Pipeline: Supporting APIs Plugin to a non-vulnerable version.
Restrict access to Jenkinsfiles and Pipeline configuration to trusted users only.

Long-Term Security Practices

Regularly review and update Jenkins plugins to ensure security patches are applied promptly.
Implement least privilege access controls to limit the impact of potential vulnerabilities.

Patching and Updates

Apply the latest security patches and updates provided by Jenkins to address the vulnerability.