viszsec/cve-2024-23897Jenkins POC of Arbitrary file read vulnerability through the CLI can lead to RCE
Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment.
Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.
This allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.
Attackers with Overall/Read permission can read entire files.
Attackers without Overall/Read permission can read the first few lines of files. The number of lines that can be read depends on available CLI commands. As of publication of this advisory, the Jenkins security team has found ways to read the first three lines of files in recent releases of Jenkins without having any plugins installed, and has not identified any plugins that would increase this line count.
Fix Description: Jenkins 2.442, LTS 2.426.3 disables the command parser feature that replaces an @ character followed by a file path in an argument with the file’s contents for CLI commands.
In case of problems with this fix, disable this change by setting the Java system property hudson.cli.CLICommand.allowAtSyntax to true. Doing this is strongly discouraged on any network accessible by users who are not Jenkins administrators.
Workaround: Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3. Applying this workaround does not require a Jenkins restart
More info at: https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
Command to run: python CVE-2024-23897 Jenkins.py -l list.txt -f /etc/passwd
The VULN output response could contains more than daemon or bin, do add in at line 28 if you wish to add more.
