Jenkins CLI Websocket Hijacking - PoC

A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441.

This exploits targets the Jenkins CLI that can be used to remotely access and issue commands to a Jenkins control server. Through this exploit a remote attacker can gain access to and establish a persistent back-door to a Jenkins control server if an administrator is tricked into visiting a malicious site while logged-in to the target Jenkins control server.

---

DISCLAIMER

This code is intended for educational purposes only and solely for the use of the Hacking & Offensive Security course at Carnegie Mellon University. This code should not be weaponized or otherwise used to craft malware. The authors explicitly condemn any attempt to do so.

---

Setting Up Jenkins

• Run "docker-compose build && docker-compose up -d"
• Navigate to http://localhost:8080, you will be prompted for an admin password
• Open a shell in the jenkins docker container (NOT THE POSTGRES ONE)
  • "docker exec -it <container_id> bash"
  • cd to directory listeed on the Jenkins page, acquire the password
• Set up a basic admin account (remember the password) and install default plugins -Configure anonymous users with basic permissions by going to Manage Jenkins > Security
  • Set authorization type to "Matrix-based"
  • Allow anonymous users to read "Overall" and "Job"

Conducting Websocket Hijacking