CVE-2024-34145: Jenkins Script Security RCE Vulnerability

CVE-2024-34145 Overview

CVE-2024-34145 is a sandbox bypass vulnerability in the Jenkins Script Security Plugin. Versions 1335.vf07d9ce377a_e and earlier are affected. The flaw involves sandbox-defined classes that shadow specific non-sandbox-defined classes, allowing sandboxed scripts to escape their intended restrictions.

Attackers with permission to define and run sandboxed scripts, including Jenkins Pipelines, can bypass the sandbox protection. Successful exploitation results in arbitrary code execution in the context of the Jenkins controller Java Virtual Machine (JVM). The Common Weakness Enumeration classification is [CWE-290] (Authentication Bypass by Spoofing).

Critical Impact
Authenticated attackers with script-definition privileges can execute arbitrary code on the Jenkins controller, compromising build infrastructure, credentials, and downstream deployment targets.

Affected Products

Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier
Jenkins controllers with the vulnerable plugin installed
Pipelines and sandboxed script consumers relying on Script Security for isolation

Discovery Timeline

2024-05-02 - Jenkins publishes Security Advisory SECURITY-3341
2024-05-02 - CVE-2024-34145 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34145

Vulnerability Analysis

The Jenkins Script Security Plugin enforces a sandbox that limits which classes and methods user-supplied Groovy scripts can invoke. The plugin performs class resolution to decide whether a referenced type is a safe, sandbox-defined class or an external class requiring approval.

The vulnerability arises when a sandbox-defined class shares a name with a specific non-sandbox-defined class. The shadowing behavior causes the sandbox to incorrectly resolve references, letting scripts reach protected functionality through the shadowed identifier. This produces an escape from script isolation into the full Jenkins controller JVM.

An attacker exploiting this issue can invoke arbitrary Java APIs, read Jenkins credentials, modify build configuration, and pivot to connected agents or cloud environments. The Jenkins controller typically holds high-value secrets, so a single successful bypass has broad blast radius.

Root Cause

The root cause is inconsistent identity resolution between sandbox-defined and non-sandbox-defined classes that share a name. The sandbox trusts a class based on its defining context but resolves method calls against a shadowed class, violating the assumption that a name uniquely identifies a type. This is classified under [CWE-290] because the sandbox is spoofed into treating an untrusted class dispatch as trusted.

Attack Vector

Exploitation requires an authenticated user with Overall/Read plus permission to define or execute sandboxed scripts, such as Job/Configure or Pipeline authoring rights. The attacker submits a crafted Groovy script or Pipeline that defines or references a class shadowing a targeted non-sandbox class. When the sandbox evaluates the script, the shadowing causes protected APIs to be reachable, producing code execution on the controller.

No verified proof-of-concept code is published in the referenced advisories. Technical details are available in the Jenkins Security Advisory SECURITY-3341 and the Openwall oss-security discussion.

Detection Methods for CVE-2024-34145

Indicators of Compromise

Unexpected Groovy class definitions in Pipeline scripts or Script Console history that redefine names matching internal Jenkins or JDK classes.
New or modified Jenkins jobs authored by low-privilege users that invoke reflection, ClassLoader, ProcessBuilder, or Runtime APIs.
Outbound network connections from the Jenkins controller JVM to unusual destinations following sandboxed job execution.
Unexplained credential access events or new SSH keys, tokens, or secrets read from the Jenkins credentials store.

Detection Strategies

Audit Jenkins config.xml and job definitions for scripts that declare classes with names colliding with hudson.*, jenkins.*, or java.* types.
Correlate Jenkins audit logs with process telemetry on the controller host to identify child processes spawned from the Jenkins JVM after sandboxed script execution.
Monitor Script Security approval logs for anomalies and repeated failed sandbox checks preceding successful script runs.

Monitoring Recommendations

Enable and centrally forward Jenkins system, security, and audit logs to a SIEM or data lake for retention and correlation.
Alert on privilege changes and job-configuration edits performed by non-administrator accounts.
Baseline outbound traffic from the Jenkins controller and alert on deviations, particularly to code-hosting or paste services.

How to Mitigate CVE-2024-34145

Immediate Actions Required

Upgrade the Jenkins Script Security Plugin to a version later than 1335.vf07d9ce377a_e as directed by the Jenkins security advisory.
Restrict Job/Configure, Pipeline authoring, and Script Console permissions to trusted administrators only.
Rotate credentials, API tokens, and SSH keys stored in Jenkins if exploitation is suspected.

Patch Information

Jenkins released a fixed version of the Script Security Plugin alongside the Jenkins Security Advisory 2024-05-02 (SECURITY-3341). Administrators should apply the update through the Jenkins Update Center and restart the controller. Verify the installed plugin version under Manage Jenkins → Plugins after the upgrade.

Workarounds

No official workaround exists; upgrading the plugin is the supported remediation per the Jenkins advisory.
As a temporary compensating control, revoke sandboxed script authoring permissions from non-administrator users until patching completes.
Isolate the Jenkins controller on a segmented network with strict egress controls to limit post-exploitation reach.

bash

# Verify Script Security Plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  list-plugins | grep script-security

# Restrict script authoring by tightening matrix-based authorization
# (perform through Manage Jenkins > Security > Authorization)