CVE-2024-54003
📋 TL;DR
Jenkins Simple Queue Plugin 1.4.4 and earlier contains a stored cross-site scripting (XSS) vulnerability where attackers with View/Create permission can inject malicious scripts into view names. This allows them to execute arbitrary JavaScript in the context of other users' browsers. All Jenkins instances using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Jenkins Simple Queue Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Attackers with View/Create permission could steal credentials, perform unauthorized actions, or deface Jenkins interface elements.
If Mitigated
With proper access controls limiting View/Create permissions, impact is reduced to authorized users only.
🎯 Exploit Status
Exploitation requires View/Create permission. Stored XSS means payload persists until removed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.5
Vendor Advisory: https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3467
Restart Required: Yes
Instructions:
1. Navigate to Jenkins Manage Jenkins > Manage Plugins. 2. Update Simple Queue Plugin to version 1.4.5 or later. 3. Restart Jenkins.
🔧 Temporary Workarounds
Remove View/Create permissions
allRestrict View/Create permissions to trusted users only to prevent exploitation.
Disable plugin
allTemporarily disable Simple Queue Plugin if not required.
Navigate to Manage Jenkins > Manage Plugins > Installed, find Simple Queue Plugin, click Disable
🧯 If You Can't Patch
- Review and restrict View/Create permissions to minimal set of trusted users
- Monitor for suspicious view name creation and audit existing view names for XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Manage Jenkins > Manage Plugins > Installed. If Simple Queue Plugin version is 1.4.4 or earlier, system is vulnerable.Check Version:
Check Jenkins web interface at Manage Jenkins > Manage Plugins > InstalledVerify Fix Applied:
Verify Simple Queue Plugin version is 1.4.5 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual view creation events
- View names containing script tags or JavaScript code
Network Indicators:
- Unexpected JavaScript execution in Jenkins interface
SIEM Query:
source="jenkins" AND (event="view_created" OR event="view_modified") AND (message="*<script*" OR message="*javascript:*")