CVE-2024-52551: Jenkins Pipeline Auth Bypass Vulnerability

CVE-2024-52551 Overview

CVE-2024-52551 affects the Jenkins Pipeline: Declarative Plugin version 2.2214.vb_b_34b_2ea_9b_83 and earlier. The plugin fails to verify whether the main Jenkinsfile script used to restart a build from a specific stage is approved. Attackers with Item/Build permission can restart a previous build even when its Jenkinsfile script is no longer approved. This bypasses the Script Security approval mechanism designed to prevent execution of unreviewed pipeline code. The flaw maps to [CWE-276: Incorrect Default Permissions] and carries a CVSS 3.1 base score of 8.0.

Critical Impact
Authenticated users with build permissions can execute unapproved pipeline scripts, potentially leading to arbitrary code execution on the Jenkins controller.

Affected Products

Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier
Jenkins installations using stage-restart functionality
CI/CD environments relying on Script Security approvals

Discovery Timeline

2024-11-13 - CVE-2024-52551 published to NVD
2024-11-13 - Jenkins releases Security Advisory SECURITY-3361
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52551

Vulnerability Analysis

The Jenkins Pipeline: Declarative Plugin extends Jenkins with a structured, opinionated syntax for defining continuous integration pipelines. One feature allows users to restart a completed build from a specific stage rather than re-executing the entire pipeline. This restart operation reloads the original Jenkinsfile associated with the prior build.

Jenkins normally enforces Script Security, which requires administrators to approve Groovy scripts before they execute in a sandboxed or unsandboxed context. Approvals can be revoked when a script is determined to be unsafe. The declarative plugin skips this approval check during the stage-restart workflow.

As a result, a user with Item/Build permission can trigger execution of a previously approved but now-revoked Jenkinsfile. This defeats the security boundary between administrators who approve scripts and users who run them.

Root Cause

The root cause is a missing authorization check in the restart-from-stage logic. The plugin loads the historical Jenkinsfile from the prior build record without invoking the Script Approval subsystem to confirm the script remains approved. This is a classic [CWE-276] incorrect default permissions weakness, where an administrative revocation is not honored by a secondary execution path.

Attack Vector

Exploitation requires an authenticated user with Item/Build permission on a target pipeline job. The attacker identifies a prior build whose Jenkinsfile contained code that was once approved but has since been revoked by an administrator. The attacker then invokes the restart-from-stage function on that build. Jenkins executes the revoked script without re-validation, granting the attacker the effective privileges of the pipeline execution context. This can lead to arbitrary Groovy execution on the Jenkins controller, secret exfiltration, and lateral movement across build agents.

No verified public proof-of-concept code is available for this issue. Refer to the Jenkins Security Advisory for authoritative technical details.

Detection Methods for CVE-2024-52551

Indicators of Compromise

Restart-from-stage events on builds whose Jenkinsfile scripts were subsequently revoked in Script Approval
Pipeline executions producing output inconsistent with the currently approved Jenkinsfile content
Unexpected credential access, agent commands, or outbound network activity originating from Jenkins build executors
Audit log entries showing restart actions initiated by non-administrative users

Detection Strategies

Review Jenkins audit logs for restartFromStage invocations and correlate them against Script Approval revocation history
Compare the Jenkinsfile hash executed during restart events with the currently approved script hash in Script Security
Alert on any pipeline execution invoking Groovy methods that are not currently in the approved signatures list
Baseline pipeline behavior per job and flag deviations in executed steps, invoked plugins, or credential usage

Monitoring Recommendations

Forward Jenkins controller and audit logs to a centralized SIEM for correlation with identity and network telemetry
Monitor the Jenkins queue.log and builds/*/log files for restart events on builds older than the latest Script Approval revocation
Track outbound connections and process execution from Jenkins agents to detect post-exploitation activity
Enable file integrity monitoring on Jenkins home, plugin directories, and secret stores

How to Mitigate CVE-2024-52551

Immediate Actions Required

Upgrade the Jenkins Pipeline: Declarative Plugin to version 2.2218.v56d0cda_37c72 or later
Audit historical builds and revoke stored artifacts for jobs whose Jenkinsfile approvals were removed
Restrict Item/Build permission to trusted users on jobs that handle sensitive credentials
Review the Script Approval page and remove any lingering approvals that should not be reinstated

Patch Information

Jenkins released the fix on 2024-11-13 in the Jenkins Security Advisory SECURITY-3361. The patched plugin re-validates the Jenkinsfile against Script Approval before executing a stage restart. Administrators should apply the update through the Jenkins Plugin Manager and restart the controller.

Workarounds

Disable the restart-from-stage capability by restricting Item/Build permission to administrators until patching is complete
Remove approvals for legacy Jenkinsfile scripts that should not be re-executed
Isolate the Jenkins controller on a segmented network to limit blast radius from unapproved script execution
Rotate credentials, tokens, and SSH keys stored in Jenkins if unauthorized restart activity is suspected

bash

# Verify installed plugin version via Jenkins CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ list-plugins | grep pipeline-model-definition

# Upgrade the plugin through the Update Center UI:
# Manage Jenkins -> Plugins -> Updates -> select "Pipeline: Declarative" -> Download and install after restart