Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-23897 — Unauthenticated arbitrary file read exploit for Jenkins CVE-2024-23897, with HTTPS and CSRF-crumb support to bypass hardened instances. | Kitploit
Tools/GitHubGitHub/machiavelliii/cve-2024-23897
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubmachiavelliii/cve-2024-23897

CVE-2024-23897

Unauthenticated arbitrary file read exploit for Jenkins CVE-2024-23897, with HTTPS and CSRF-crumb support to bypass hardened instances.

View Repository
9h 44m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-23897 — HTTPS + CSRF-crumb aware PoC

cve-2024-23897-crumb.py — unauthenticated arbitrary file read against Jenkins <= 2.441 / LTS <= 2.426.2 (fixed in 2.442 / LTS 2.426.3).

What this adds over the public PoCs

The widely-used PoCs — exploit-db 51993, xaitax/CVE-2024-23897, and the ProjectDiscovery nuclei template — are HTTP-only and send no CSRF crumb. Against a Jenkins instance that is:

  1. behind TLS, and
  2. has CSRF protection enabled on the CLI,

they fail with 403 No valid crumb was included in the request, which is indistinguishable from "patched" and produces a false negative.

This variant:

  • speaks HTTPS (and plain HTTP via --http);
  • pulls a usable CSRF crumb + matching JSESSIONID from the unauthenticated /cli error page, then replays them on the duplex channel;
  • degrades gracefully — if the instance does not enforce CSRF, no crumb is sent and it behaves like the standard PoC.

    • Net effect: it detects and exploits hardened-but-unpatched instances that the public tooling reports as safe.

    Usage

    root@kitploit:~
    python3 cve-2024-23897-crumb.py <host> [file] [--http] [--port N]

python3 cve-2024-23897-crumb.py jenkins.example.com
python3 cve-2024-23897-crumb.py jenkins.example.com /etc/shells
python3 cve-2024-23897-crumb.py 10.0.0.5 /etc/passwd --http --port 8080

    Python 3 standard library only. Read-only: sends help "@<file>"; nothing is written, uploaded, or executed.

    Extraction notes

    help echoes a file's leading line(s) — the first line in the Too many arguments: message plus following lines in the (default: ...) field. Works well on files whose first line carries several fields or is long:

    • /etc/passwd, /etc/shells
    • /proc/net/arp, /proc/net/route (internal IPs, gateway, MACs)
    • /proc/mounts (container/storage layout)

    Files with a very short first line (e.g. /etc/hostname) fall through to an auth-error path and return nothing via help. Whole-file extraction uses the connect-node command instead, but that requires the anonymous user to hold Overall/Read — often not granted, in which case the read primitive still works but only the leading lines come back.

    Responsible use

    Point it only at hosts you are authorised to test. The same channel exposes state-changing CLI commands (enable-job, reload-configuration, …); this script deliberately uses only the read-only help path.

    Download Tool