CVE-2024-34144: 
Java vulnerability analysis and mitigation

CVE-2024-34144 is a sandbox bypass vulnerability discovered in Jenkins Script Security Plugin versions 1335.vf07d9ce377a_e and earlier. The vulnerability was disclosed on May 2, 2024, affecting the Jenkins automation server's Script Security Plugin. This security flaw allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass sandbox protection through crafted constructor bodies (Jenkins Advisory).

The vulnerability exists in the sandbox feature of Script Security Plugin that is designed to allow low-privileged users to define and execute generally safe scripts. The specific technical issue involves crafted constructor bodies that invoke other constructors, which can be used to construct any subclassable type via implicit casts. This vulnerability is part of multiple sandbox bypass issues caused by an incomplete fix of SECURITY-2824. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CISA-ADP).

When exploited, this vulnerability allows attackers to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. This means that attackers with permission to define and run sandboxed scripts can potentially gain unauthorized access to execute malicious code, compromising the security of the Jenkins environment (Jenkins Advisory).

The vulnerability requires an attacker to have permission to define and run sandboxed scripts, including Pipelines. The exploit involves using crafted constructor bodies that invoke other constructors to bypass sandbox protection mechanisms (Jenkins Advisory).

The vulnerability has been fixed in Script Security Plugin version 1336.vf33a_a_9863911. The fix includes additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. Specifically, calls to other constructors using 'this' are now intercepted by the sandbox, and classes in packages that can be shadowed by Groovy-defined classes are no longer ignored by the sandbox when intercepting super constructor calls (Jenkins Advisory).