Jenkins Remoting Arbitrary File Read via Channel#preloadJar (CVE-2024-43044)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID and CVE Number: - SECURITY-3430 - CVE-2024-43044 2. Vulnerability Description: - Jenkins uses the Remoting library (typically agent.jar or remoting.jar) for communication between the controller and agents. This library allows agents to load classes and classloader resources from the controller. - Remoting also permits Jenkins plugins to transmit entire JAR files to agents via the Channel#preloadJar API. In Jenkins 2.470 and earlier versions, and LTS 2.452.3 and earlier, this feature was used by the following plugins: bouncycastle API, Groovy, Ivy, TeamConcert. - In Remoting versions 3256.v88a_f6e922152 and earlier (excluding 3206.3208.v409508a_675ff and 3248.3250.v3277a_8e88c9b_), and in Jenkins 2.470 and earlier, LTS 2.452.3 and earlier, calling Channel#preloadJar results in retrieving files from the controller to the agent using ClassLoaderProxy#fetchJar. Additionally, the implementation of ClassLoaderProxy#fetchJar on the controller does not prevent agents from requesting paths that read from the controller’s filesystem. 3. Impact of the Vulnerability: - This vulnerability allows the agent process, code running on the agent, and attackers with Agent/Connect permissions to read arbitrary files from the Jenkins controller’s filesystem. 4. Mitigation and Fix: - In Jenkins 2.471, LTS 2.452.4, and LTS 2.462.1, the Remoting library now sends JAR file contents via Channel#preloadJar and uses ClassLoaderProxy#fetchJar only within the agent, so agents no longer need to request JAR file contents from the controller. - Administrators can disable this protection by setting the Java system property , but this is only recommended when code is running on the agent (including build scripts and test code retrieved from SCM). 5. Affected Versions: - Jenkins weekly versions 2.470 and earlier, LTS versions 2.452.3 and earlier. 6. Credits: - The vulnerability was discovered by Daniel Beck (CloudBees, Inc.), jiangchenwei (Nebulalab), and yangyue (Nebulalab). This information provides a detailed description of the vulnerability’s nature, scope of impact, and remediation steps, which is crucial for understanding the severity and how to address it.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Remoting Arbitrary File Read via Channel#preloadJar (CVE-2024-43044)