Jenkins Matrix Authorization Strategy Plugin Unsafe Deserialization Vulnerability Allowing Arbitrary Class Instantiation

A vulnerability exists in the Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9, inclusive. The plugin improperly handles deserialization of inheritance strategies by invoking parameterless constructors of specified classes without restrictions. This flaw enables attackers with Item/Configure permission to instantiate arbitrary classes, potentially leading to information disclosure or other impacts based on the classes available on the classpath.

Impact

Exploitation of this vulnerability could allow for unauthorized instantiation of classes, potentially leading to information disclosure or other impacts, depending on the classes available on the classpath.

Remediation

Users of the Matrix Authorization Strategy Plugin should update to version 3.2.10, which includes a fix for this vulnerability by ensuring that only valid inheritance strategy implementations can be instantiated.