Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.
**CVE-2024-23897(Arbitrary File Read Vulnerability)**
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
**Affected versions:** Jenkins 2.441 and earlier, LTS 2.426.2 and earlier
This exploit scans whether the provided target is vulnerable to CVE-2024-23897 and reads the file supplied, from the remote vulnerable server.
**Usage:** python3 CVE-2024-23897.py -u http://localhost:8888/ -f /etc/passwd
For this exploit to work, atleast one of the following conditions have to be met:
1. Legacy mode authorization is enabled.
2. Configuration “Allow anonymous read access” is checked in the “logged-in users can do anything” authorization mode.
3. The signup feature is enabled.
**Note:** If the exploit takes too long to complete/reads only the first few bytes of the file, terminate the exploit and run it again. Also this exploit only works if the vulnerable Jenkins instace is configured with default settings
You can also manually do the exploit with jenkins-cli.jar. To know more, refer the link below
https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897
**References:**
https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897
https://www.splunk.com/en_us/blog/security/security-insights-jenkins-cve-2024-23897-rce.html
**Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited.**
登录后查看神龙缓存的 POC 文件快照
登录查看