CVE-2024-52550

What it actually does

This is an authorization bypass in Jenkins Pipeline: Groovy Plugin. A user who has Item/Build permission can rebuild an earlier Pipeline build even when the main Jenkinsfile script associated with that build is no longer approved by Jenkins script approval controls. The flaw is in the rebuild authorization/validation path: it fails to re-check the approval state of the main Pipeline script before execution. If an attacker can trigger rebuilds, they may cause previously unapproved Pipeline Groovy code to run in the Jenkins execution context, potentially enabling unauthorized build actions, access to build-time credentials available to the job, code execution on build agents, modification of artifacts, or further movement through CI/CD workflows depending on job configuration and permissions.

Why it matters to the business

A compromised or malicious Jenkins user with build privileges could bypass CI/CD governance controls and run Pipeline code that administrators or reviewers had explicitly not approved. This can affect software supply-chain integrity by allowing unauthorized build logic, tampered artifacts, credential exposure, deployment manipulation, or disruption of automated release processes. The issue has a high CVSS score but low current EPSS and is not listed in CISA KEV, so it should be prioritized especially for Jenkins instances where many users can trigger builds, jobs have access to production deployment credentials, or Pipeline rebuild functionality is widely used.

How an attack unfolds

An attacker first obtains or already has a Jenkins account with Item/Build permission for a Pipeline job. They identify a prior build whose Jenkinsfile contained Groovy Pipeline script that is no longer approved under Jenkins script approval policy. Instead of submitting or approving new script content, the attacker uses the rebuild capability to request execution of that older build. In vulnerable versions of Pipeline: Groovy Plugin, the rebuild path does not validate whether the main Jenkinsfile is currently approved, so Jenkins proceeds with the rebuild. The unapproved Pipeline script then executes with the job's configured privileges and access to its build environment, which may include workspace files, source code, environment variables, credentials bound to the job, agent-level capabilities, and deployment steps. The attacker can use this to run unauthorized commands, alter build outputs, exfiltrate secrets exposed during the build, or trigger downstream release actions.

How to fix it

Upgrade Jenkins Pipeline: Groovy Plugin to version 3993.v3e20a_37282f8 or later, which refuses to rebuild a build when the main Jenkinsfile script is unapproved. The upstream source fix is associated with jenkinsci/workflow-cps-plugin commit 478dd9e956c3efd5a4caeb2853ed90fe6b43bb54. Versions 3990.vd281dd77a_388 and earlier are affected, except 3975.3977.v478dd9e956c3. As compensating controls until the plugin is upgraded, restrict Item/Build permission to trusted users, disable or tightly control rebuild functionality where possible, review and minimize job credentials, move sensitive deployment actions behind additional approvals, and ensure Jenkins script approval queues and rejected scripts are reviewed by administrators.

How to confirm the fix worked

Confirm the installed Pipeline: Groovy Plugin version from Jenkins Plugin Manager or plugin inventory and verify it is 3993.v3e20a_37282f8 or later, or that the deployed workflow-cps code includes commit 478dd9e956c3efd5a4caeb2853ed90fe6b43bb54. Review plugin dependency resolution to ensure Jenkins is not loading an older workflow-cps plugin from disk. Functional validation can be performed in a controlled non-production Jenkins instance by creating or using a Pipeline build whose Jenkinsfile is unapproved, then confirming that attempts to rebuild it are refused rather than executed. Also validate that Item/Build permissions are limited to intended groups and that no broad authenticated or anonymous users can trigger Pipeline rebuilds.

Typical attack path

1. Gain authenticated access to Jenkins or use an existing account with Item/Build permission on a Pipeline job.
2. Locate a Pipeline job with historical builds that used a Jenkinsfile script now considered unapproved or unsafe.
3. Trigger a rebuild of the prior build through the Jenkins UI, API, or rebuild plugin workflow.
4. Rely on the vulnerable Pipeline: Groovy Plugin behavior to skip the current script-approval check for the rebuilt Jenkinsfile.
5. Execute the unapproved Pipeline logic in the job's build context.
6. Use job-level access to read workspace data, access bound credentials, modify artifacts, run commands on agents, or invoke deployment stages.

How to detect it

Investigate Jenkins access logs, audit logs, job build histories, Pipeline console logs, and script approval records for evidence of rebuilds that executed after the associated Jenkinsfile became unapproved. Focus on POST requests to rebuild endpoints, build causes showing manual user-triggered rebuilds, and Pipeline jobs that ran old build definitions. Compare timestamps of rebuild events with changes in script approval state, rejected approvals, plugin upgrade timing, and job configuration changes. Review console logs for unexpected shell commands, network utilities, credential access, artifact modifications, or deployment stages. Examine Jenkins home artifacts such as job build metadata, build.xml files, workflow execution data, and scriptApproval.xml for evidence that a previously rejected or unapproved script was later executed. If centralized audit logging is enabled, search for the initiating user, source IP, target job path, build number, and any rebuild action around suspicious Pipeline executions.

• /rebuild
• POST /job/
• Started by user
• Rebuild
• scriptApproval.xml
• RejectedAccessException
• Scripts not permitted to use
• org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition
• workflow-cps
• program.dat
• build.xml
• Jenkinsfile
• hudson.model.Cause$UserIdCause

What your security team should do

• Upgrade Pipeline: Groovy Plugin to 3993.v3e20a_37282f8 or later across Jenkins controllers as the primary remediation.
• Inventory Jenkins jobs where users with Item/Build permission are broader than job administrators or trusted CI/CD maintainers.
• Review recent rebuild activity for Pipeline jobs, especially rebuilds of old builds after script approval changes or rejected script approval events.
• Temporarily restrict rebuild and build permissions for sensitive jobs that can access production credentials, signing keys, deployment tokens, or release automation.
• Audit Jenkins credential bindings used by Pipeline jobs and remove unnecessary secrets from jobs that can be rebuilt by non-administrators.
• Review scriptApproval.xml and Jenkins administrative logs for recently rejected, cleared, or changed Pipeline script approvals.
• Monitor for suspicious Pipeline console output indicating shell execution, credential dumping, artifact tampering, or unexpected deployment actions.
• Where feasible, require code review and branch protection for Jenkinsfiles and use least-privilege service accounts for build agents and deployments.