CVE-2024-52549

Overview

CVE-2024-52549 is a medium-severity vulnerability in the Jenkins Script Security Plugin, versions 1367.vdf2fc45f229c and earlier (excluding the patched releases 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776). The plugin fails to perform a required permission check in a method that handles form validation. [2]

Exploitation

An attacker with only Overall/Read permission — the lowest access level in Jenkins — can exploit this flaw by invoking the affected form validation method. No additional authentication or privileges are needed beyond that read-level access. Since the method does not enforce the expected Overall/Administer permission, the attacker can send crafted requests to the Jenkins controller. [1][2]

Impact

Successful exploitation allows the attacker to check for the existence of arbitrary files on the Jenkins controller's file system. While this is a file-existence oracle and does not directly expose file contents, it can be used to map the file system, identify the presence of sensitive files (e.g., credentials, configuration files, or custom scripts), and potentially aid in further attacks. [2][3]

Remediation

The plugin version 1368.vb_b_402e3547e7 resolves the issue by requiring the Overall/Administer permission for the affected form validation method. Jenkins administrators should update the Script Security Plugin to this version or later immediately. No workarounds are documented, and the vendor advisory recommends the upgrade as the sole mitigation. [2]