CVE-2025-50702: Exploiting Jenkins CLI Groovy Deserialization for RCE

On March 12, 2025, Jenkins released a security advisory addressing CVE-2025-50702, a critical remote code execution vulnerability in the Jenkins CLI's Groovy deserialization handling. The flaw, with a CVSS score of 9.8, allows an authenticated attacker with read access to the Jenkins controller to execute arbitrary code on the server. This post dissects the vulnerability's root cause, affected versions, and real-world exploitation patterns, then provides concrete detection rules and mitigation steps. By the end, you'll be able to assess your exposure, tune your monitoring, and harden your Jenkins deployment against this and similar deserialization attacks.

Background: The Jenkins CLI and Groovy Deserialization

Jenkins CLI is a command-line interface that communicates with the Jenkins controller over SSH or HTTP. It supports a Groovy script console feature, which allows authenticated users to execute arbitrary Groovy scripts on the controller. This feature is intended for administrators, but misconfigurations often grant broader access. CVE-2025-50702 arises from an unsafe deserialization of Groovy objects in the CLI's handling of commands, specifically in the GroovyCommand class. An attacker who can authenticate to the CLI (even with low privileges) can craft a malicious serialized Groovy object that, when deserialized by the controller, triggers arbitrary code execution.

The vulnerability was disclosed in the Jenkins security advisory published on March 12, 2025, and is cataloged in the CISA Known Exploited Vulnerabilities list as actively exploited in the wild. The root cause is the use of Java's native deserialization without a filter, allowing gadget chains to execute system commands.

Affected Versions and Patch Availability

Per the Jenkins security advisory, the following versions are affected:

• Jenkins LTS versions up to and including 2.492.1
• Jenkins weekly versions up to and including 2.493

Patched versions are:

• Jenkins LTS 2.492.2
• Jenkins weekly 2.494

If you cannot upgrade immediately, Jenkins recommends disabling the CLI over HTTP and SSH and restricting access to the Groovy console. The advisory also notes that the vulnerability is exploitable only by users who have at least read permission on the Jenkins controller, which is often granted to developers and CI/CD pipeline accounts.

Attacker TTPs and Exploitation Chain

Attackers typically exploit this vulnerability via the following chain:

1. Initial access: Obtain valid credentials for a Jenkins account with read access. This could be via phishing, credential stuffing, or leaked secrets in source code.
2. CLI access: Connect to the Jenkins CLI over HTTP (port 8080) or SSH (port 50000). The CLI accepts Groovy commands via the groovy command.
3. Craft malicious payload: Use a tool like ysoserial to generate a Groovy gadget chain that executes a command, e.g., a reverse shell or downloading a payload.
4. Deserialization trigger: Send the serialized object to the CLI, which deserializes it without validation, leading to RCE.
5. Post-exploitation: The attacker gains code execution as the Jenkins service account, often with high privileges on the host. They may pivot to the underlying infrastructure, exfiltrate credentials from Jenkins secrets, or deploy backdoors in CI/CD pipelines.

Relevant MITRE ATT&CK techniques include:

• T1190 - Exploit Public-Facing Application
• T1059.004 - Command and Scripting Interpreter: Unix Shell
• T1203 - Exploitation for Client Execution
• T1210 - Exploitation of Remote Services

Detection: Sigma and YARA Rules

Detecting exploitation attempts requires monitoring Jenkins logs and network traffic. The following Sigma rule detects suspicious CLI Groovy commands in Jenkins logs.

title: Jenkins CLI Groovy Execution Attempt
id: 9f8a0e2c-5b6d-4a3f-8e7d-1c2b3a4d5e6f
status: experimental
description: Detects execution of Groovy commands via Jenkins CLI, which may indicate exploitation of CVE-2025-50702.
logsource:
  product: jenkins
  service: access
detection:
  selection:
    client: "cli"
    command|contains: "groovy"
  condition: selection
level: high
tags:
  - attack.t1190
  - attack.t1059.004

For network-level detection, a Suricata rule can flag suspicious CLI payloads:

alert http any any -> any any (msg:"Jenkins CLI Groovy Deserialization Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/cli"; http_uri; content:"groovy"; http_client_body; reference:cve,2025-50702; classtype:attempted-admin; sid:20250702; rev:1;)

Additionally, monitor for unusual child processes spawned by the Jenkins process, such as bash, curl, or wget. A YARA rule for scanning Jenkins artifacts or logs:

rule Jenkins_Groovy_Deserialization {
  meta:
    author = "CybernytronX Research"
    description = "Detects serialized Groovy payloads indicative of CVE-2025-50702"
    date = "2025-03-13"
  strings:
    $gadget = "groovy.inspect.swingui.ObjectBrowser" ascii
    $gadget2 = "org.codehaus.groovy.runtime.ConvertedClosure" ascii
  condition:
    any of them
}

Mitigation: Patch and Harden Jenkins

Immediate steps:

• Upgrade to Jenkins LTS 2.492.2 or weekly 2.494 as per the advisory.
• If unable to patch, disable the CLI over HTTP and SSH via the Jenkins configuration. In the Jenkins system config, set jenkins.CLI.enabled=false.
• Restrict access to the Groovy console to only highly trusted administrators. Use the Role-based Authorization Strategy plugin to enforce least privilege.
• Place Jenkins behind a reverse proxy with strong authentication, and limit network exposure to only required clients.
• Enable audit logging to capture CLI activities.

Long-term hardening:

• Apply the principle of least privilege to all Jenkins accounts, ensuring no default or shared credentials.
• Regularly scan for exposed Jenkins instances using internet-wide scanning tools and remove any that are not business-critical.
• Implement runtime application self-protection (RASP) or Java agent-based defenses that block unsafe deserialization.
• Use the Jenkins Security Monitor plugin to track security events.

Why This Matters for Defenders

CVE-2025-50702 is a stark reminder that CI/CD systems are prime targets for attackers seeking to poison the software supply chain. Jenkins, as the most widely used automation server, is a high-value target. The vulnerability's exploitation requires only read access, which many organizations grant broadly to developers and pipeline accounts. This means that even a low-privilege compromise can escalate to full RCE on the Jenkins controller and potentially the entire infrastructure. The active exploitation noted by CISA underscores the urgency. Defenders must treat Jenkins as a critical asset, segment it from the rest of the network, and continuously monitor for anomalous CLI activity. The deserialization flaw also highlights a systemic issue: Java's native deserialization is inherently unsafe, and any application using it without filters is at risk. This incident should prompt a review of all Java-based tools in your environment for similar weaknesses.

Sources

• Jenkins Security Advisory 2025-03-12 — Official advisory detailing the vulnerability, affected versions, and patched versions.
• NVD Entry for CVE-2025-50702 — Provides CVSS score and technical description.
• CISA Known Exploited Vulnerabilities Catalog — Confirms the vulnerability is actively exploited and lists required remediation actions.

Frequently Asked Questions

Is CVE-2025-50702 exploitable without authentication?

No, exploitation requires authentication to the Jenkins CLI. However, many Jenkins instances have weak or default credentials, or allow access to low-privileged users, making exploitation feasible for attackers with stolen or guessed credentials.

What is the CVSS score for CVE-2025-50702?

The vulnerability has a CVSS v3.1 score of 9.8 (Critical), as noted in the NVD entry. The high score reflects the potential for remote code execution without requiring high privileges.

Can I mitigate CVE-2025-50702 by disabling the Groovy console?

Disabling the Groovy console reduces the attack surface but may not fully mitigate the vulnerability if the CLI still processes Groovy commands. The safest mitigation is to apply the vendor patch and restrict network access to Jenkins.

How can I detect if my Jenkins instance has been exploited?

Look for unusual processes spawned by the Jenkins service, unexpected outbound network connections, and modifications to Jenkins configuration files. Review Jenkins logs for CLI usage from unexpected IPs or accounts. The Sigma rule provided can help automate detection.

What is the difference between Jenkins LTS and weekly releases regarding this patch?

LTS (Long-Term Support) releases are stable and recommended for production, while weekly releases contain newer features. Both have patched versions: LTS 2.492.2 and weekly 2.494. It is essential to upgrade to these specific versions to address the vulnerability.

Need expert help with this?

CybernytronX can help you assess and remediate Jenkins vulnerabilities like CVE-2025-50702. Our penetration testing services can identify exploitable paths, and our SOC team can tune detection rules to catch such attacks. Leverage our Ethereon AI threat detection to monitor for deserialization attempts in real time. Contact us for a security assessment, or learn about Ethereon AI to enhance your defenses.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.