xaitax/cve-2024-23897PoC and scanner for CVE-2024-23897 targeting Jenkins <= 2.441 & LTS 2.426.2. Supports single targets, CIDR ranges, file reading, and CLI command execution.
Exploitation and scanning tool specifically designed for Jenkins versions <= 2.441 & <= LTS 2.426.2. It leverages CVE-2024-23897 to assess and exploit vulnerabilities in Jenkins instances.
Ensure you have the necessary permissions to scan and exploit the target systems. Use this tool responsibly and ethically.
python CVE-2024-23897.py -t <target> -p <port> -f <file>
or
python CVE-2024-23897.py -i <input_file> -f <file>
Parameters:
-t or : Specify the target IP(s). Supports single IP, IP range, comma-separated list, or CIDR block.--target-i or --input-file: Path to input file containing hosts in the format of http://1.2.3.4:8080/ (one per line).-o or --output-file: Export results to file (optional).-p or --port: Specify the port number. Default is 8080 (optional).-f or --file: Specify the file to read on the target system.-o or --output: Path to output file for saving the results (optional).-c or --command: The jenkins-cli.jar command [help|who-am-i|connect-node]. Default is 'help' (optional).-l or --language: The language code you want to use. Default is en_US (optional).-c COMMAND which allows the testing of other jenkins-cli.jar commands: who-am-i,connect-node. Default remains "help".-l LANGUAGE which allows for the 5 byte language code, i.e. en_US, cn_ZH, etc. The default is en_US.-i INPUT_FILE).-o OUTPUT_FILE).Contributions are welcome. Please feel free to fork, modify, and make pull requests or report issues.
Alexander Hagenah
This tool is meant for educational and professional purposes only. Unauthorized scanning and exploiting of systems is illegal and unethical. Always ensure you have explicit permission to test and exploit any systems you target.