Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-52550

CVE-2024-52550: Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-52550
GHSA ID
GHSA-mrpr-vr82-x88r
EPSS Score
0.01731%
CWE
CWE-285
Published
11/13/2024
Updated
11/26/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins.workflow:workflow-cpsmaven< 3993.v3e20a3993.v3e20a

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing re-validation of script approvals during rebuild operations. The primary culprit is ReplayAction#run, which initiates rebuilds without checking current script approval status (CWE-285). CpsFlowExecution#parseScript is implicated because it handles script execution but uses previously approved state rather than re-checking (CWE-354). These inferences align with the advisory's description of the flaw in rebuild authorization checks and the plugin's architecture.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins Pip*lin*: *roovy Plu*in ****.v*********_*** *n* **rli*r, *x**pt ****.****.v************ *o*s not ****k w**t**r t** m*in (J*nkins*il*) s*ript *or * r**uilt *uil* is *pprov**, *llowin* *tt**k*rs wit* It*m/*uil* p*rmission to r**uil* * pr*vious

Reasoning

T** vuln*r**ility st*ms *rom missin* r*-v*li**tion o* s*ript *pprov*ls *urin* r**uil* op*r*tions. T** prim*ry *ulprit is `R*pl*y**tion#run`, w*i** initi*t*s r**uil*s wit*out ****kin* *urr*nt s*ript *pprov*l st*tus (*W*-***). `*ps*low*x**ution#p*rs*S*