CVE-2024-52554: Jenkins Shared Library Auth Bypass Flaw

CVE-2024-52554 Overview

CVE-2024-52554 affects the Jenkins Shared Library Version Override Plugin, versions 17.v786074c9fce7 and earlier. The plugin declares folder-scoped library overrides as trusted, which causes them to bypass the Jenkins Script Security sandbox. Attackers holding Item/Configure permission on a folder can configure a folder-scoped library override that executes outside sandbox protection. The flaw is categorized under [CWE-862] (Missing Authorization) and enables sandbox escape leading to arbitrary Groovy execution within the Jenkins controller context.

Critical Impact
Authenticated users with Item/Configure folder permissions can execute arbitrary code on the Jenkins controller by defining folder-scoped shared library overrides that run without sandbox restrictions.

Affected Products

Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier
Jenkins controllers with the plugin installed and folder-level delegated permissions
CI/CD pipelines relying on Script Security sandbox enforcement for shared libraries

Discovery Timeline

2024-11-13 - Jenkins publishes Security Advisory SECURITY-3466
2024-11-13 - CVE-2024-52554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52554

Vulnerability Analysis

Jenkins Pipeline uses Groovy shared libraries to package reusable pipeline code. The Script Security plugin normally sandboxes untrusted Groovy execution, blocking access to sensitive APIs and the underlying JVM. Libraries designated as trusted skip the sandbox and run with full Jenkins controller privileges.

The Shared Library Version Override Plugin allows administrators to override which library version is loaded at the folder level. The plugin incorrectly marks these folder-scoped overrides as trusted. As a result, Groovy code loaded through a folder override runs outside the sandbox, regardless of whether the original global library was defined as untrusted.

An attacker with Item/Configure permission on any folder can point the override at attacker-controlled Groovy code. That code then executes on the Jenkins controller with the same privileges as trusted pipeline code, allowing credential theft, agent compromise, and lateral movement across the CI/CD environment.

Root Cause

The plugin fails to enforce authorization boundaries defined by the Script Security model. Folder-scoped overrides should inherit the trust level of the original library configuration or be treated as untrusted by default. Instead, the plugin unconditionally treats them as trusted, violating the least-privilege principle that Script Security is designed to enforce.

Attack Vector

Exploitation requires network access to the Jenkins web interface and a low-privileged account with Item/Configure permission on at least one folder. The attacker configures a folder-scoped shared library override that references a Git repository under their control. When any pipeline in that folder loads the library, the attacker's Groovy code executes on the controller without sandbox restrictions. The Script Security approval workflow is not triggered because the plugin classifies the code as pre-trusted.

See the Jenkins Security Advisory #SECURITY-3466 for the official technical description.

Detection Methods for CVE-2024-52554

Indicators of Compromise

New or modified folder-scoped library override configurations referencing external or unfamiliar Git repositories
Groovy execution on the Jenkins controller invoking sensitive APIs such as Jenkins.instance, hudson.model.User, or ProcessBuilder from library code
Unexpected outbound connections from the Jenkins controller to attacker-controlled source control endpoints
Pipeline build logs referencing library retrieval from folders where overrides were not previously used

Detection Strategies

Audit the Jenkins configuration history plugin logs for changes to folderLibraries and library override entries at the folder level
Review Jenkins audit logs for Item/Configure actions performed by non-administrator accounts followed by pipeline executions
Inspect installed plugin versions and flag any instance of Shared Library Version Override at 17.v786074c9fce7 or earlier
Correlate controller process behavior with pipeline execution timestamps to identify library code running outside sandbox constraints

Monitoring Recommendations

Forward Jenkins audit and system logs to a centralized SIEM for correlation of configuration changes and pipeline executions
Alert on any Jenkins process spawning shells, network utilities, or credential-access tooling shortly after a folder library override change
Monitor Git access patterns from the Jenkins controller for connections to previously unused repositories
Track privilege assignments and folder-level ACL changes across Jenkins projects

How to Mitigate CVE-2024-52554

Immediate Actions Required

Identify all Jenkins instances running the Shared Library Version Override Plugin at version 17.v786074c9fce7 or earlier
Restrict Item/Configure folder permissions to trusted administrators until a fixed release is deployed
Enumerate existing folder-scoped library overrides and validate each override against an approved source repository allowlist
Rotate credentials stored in Jenkins if unauthorized folder overrides are found in configuration history

Patch Information

At the time of the advisory, no fixed version of the Shared Library Version Override Plugin was announced. Refer to the Jenkins Security Advisory #SECURITY-3466 for the current patch status and any subsequent plugin releases addressing this issue.

Workarounds

Uninstall the Shared Library Version Override Plugin if folder-scoped library overrides are not required in the environment
Remove Item/Configure permissions from non-administrator users and groups on folders that permit library overrides
Consolidate shared libraries under global configuration where Script Security sandbox rules can be enforced consistently
Require code review and approval before any folder-scoped library override is added or modified

bash

# List installed Jenkins plugins and versions via CLI
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  list-plugins | grep -i "shared-library-version-override"

# Review folder-level permission assignments
java -jar jenkins-cli.jar -s https://jenkins.example.com/ \
  -auth admin:$JENKINS_TOKEN \
  groovy = <<'EOF'
import jenkins.model.Jenkins
Jenkins.instance.getAllItems(com.cloudbees.hudson.plugins.folder.Folder.class).each { folder ->
  println "Folder: ${folder.fullName}"
  folder.properties.each { prop -> println "  Property: ${prop.class.name}" }
}
EOF