CVE-2024-54003: Jenkins Simple Queue XSS Vulnerability

CVE-2024-54003 Overview

CVE-2024-54003 is a stored cross-site scripting (XSS) vulnerability in the Jenkins Simple Queue Plugin version 1.4.4 and earlier. The plugin fails to escape the view name when rendering it, allowing attackers with View/Create permission to inject arbitrary JavaScript into Jenkins views. Any user who subsequently visits the affected view executes the attacker-controlled script in their browser session. The flaw is classified under CWE-79 and is tracked in Jenkins Security Advisory 2024-11-27.

Critical Impact
Attackers with View/Create permission can execute arbitrary JavaScript in the browsers of Jenkins users, enabling session theft, action forgery, and privilege escalation within the Jenkins controller.

Affected Products

Jenkins Simple Queue Plugin 1.4.4
Jenkins Simple Queue Plugin versions prior to 1.4.4
Jenkins controllers with the vulnerable plugin installed

Discovery Timeline

2024-11-27 - Jenkins publishes security advisory SECURITY-3467
2024-11-27 - CVE-2024-54003 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54003

Vulnerability Analysis

The Simple Queue Plugin renders user-supplied view names directly into HTML output without applying HTML entity encoding. When a user with View/Create permission creates a view containing HTML or JavaScript characters in its name, the plugin persists this value and later reflects it into rendered pages. Because the payload is stored server-side, every subsequent page load by any Jenkins user triggers execution.

Stored XSS in Jenkins carries elevated impact because Jenkins controllers manage build pipelines, credentials, and remote agent execution. A payload executing in an administrator's browser can invoke Jenkins REST endpoints, exfiltrate credentials, or trigger new builds. The EPSS score places this vulnerability in the top percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing output escaping in the plugin's view-rendering logic. View names are treated as trusted display text rather than untrusted input requiring contextual HTML encoding. This omission maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker requires an authenticated Jenkins account with View/Create permission. The attacker creates a view whose name contains a JavaScript payload embedded in HTML tags or event handlers. When any legitimate user browses to the view listing or the view itself, the payload executes with that user's Jenkins session. If the victim holds administrator rights, the attacker gains effective control of the Jenkins instance. Full technical details are available in the Jenkins Security Advisory 2024-11-27.

Detection Methods for CVE-2024-54003

Indicators of Compromise

Jenkins view names containing HTML tags such as <script>, <img>, or <svg> with event handlers
Unexpected outbound HTTP requests from Jenkins user browsers to attacker-controlled domains after loading view pages
Newly created views by low-privilege users immediately followed by administrator page loads
Audit log entries showing view creation with unusual character sequences in the name field

Detection Strategies

Query the Jenkins configuration and view metadata for names containing <, >, or on*= event handler attributes
Inspect the Jenkins audit trail for view creation events performed by non-administrator accounts
Monitor browser telemetry for script execution originating from Jenkins controller domains that references external hosts

Monitoring Recommendations

Enable Jenkins audit logging and forward events to a centralized SIEM for correlation across view creation and administrator authentication events
Alert on outbound network connections from user workstations to unfamiliar domains immediately following Jenkins access
Track Simple Queue Plugin version across all Jenkins controllers and flag hosts running 1.4.4 or earlier

How to Mitigate CVE-2024-54003

Immediate Actions Required

Identify all Jenkins controllers running the Simple Queue Plugin and inventory their installed versions
Restrict View/Create permission to trusted users until the plugin is updated or removed
Audit existing views for suspicious names containing HTML or script fragments and delete any that appear malicious
Rotate Jenkins credentials and API tokens that may have been exposed to browsers of users who viewed a poisoned view

Patch Information

As of the Jenkins Security Advisory dated 2024-11-27, no fixed version of the Simple Queue Plugin was announced in the advisory. Consult the Jenkins Security Advisory 2024-11-27 for the latest remediation status and any subsequent plugin release addressing SECURITY-3467.

Workarounds

Uninstall the Simple Queue Plugin if it is not required for build queue management
Limit View/Create permission using Jenkins matrix-based or role-based authorization to administrators only
Enforce the Jenkins Content Security Policy header to reduce the impact of injected scripts on rendered pages

bash

# Restrict View/Create permission via Jenkins CLI script console
# Run in Manage Jenkins > Script Console
import jenkins.model.Jenkins
import hudson.security.Permission

def strategy = Jenkins.instance.getAuthorizationStrategy()
println "Current strategy: ${strategy.class.name}"
// Review users granted hudson.model.View.Create and revoke where inappropriate