Unauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through @-expansion command parser flaw.
Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.
CVE-2024-23897(Arbitrary File Read Vulnerability) Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Affected versions: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier
This exploit scans whether the provided target is vulnerable to CVE-2024-23897 and reads the file supplied, from the remote vulnerable server.
Usage: python3 CVE-2024-23897.py -u http://localhost:8888/ -f /etc/passwd
For this exploit to work, atleast one of the following conditions have to be met:
Note: If the exploit takes too long to complete/reads only the first few bytes of the file, terminate the exploit and run it again. Also this exploit only works if the vulnerable Jenkins instace is configured with default settings
You can also manually do the exploit with jenkins-cli.jar. To know more, refer the link below https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897
https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897
https://www.splunk.com/en_us/blog/security/security-insights-jenkins-cve-2024-23897-rce.html
Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited.
