CVE-2024-23897
About
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Rainforest analyst review
Jenkins' built-in CLI uses an argument parser (args4j) that, by design, replaces an argument beginning with @ followed by a path with the contents of that file. That expansion was never disabled, so an unauthenticated attacker can invoke a CLI command with an @-prefixed path and have Jenkins read arbitrary files off the controller and return their contents in the response, one file at a time. Depending on configured permissions, even limited anonymous read access is enough to start pulling data.
The files worth reading on a Jenkins controller are exactly the sensitive ones: credentials stores, SSH keys, secrets, and the master key used to decrypt them, which can be chained toward full remote code execution and downstream compromise of everything Jenkins builds and deploys. Public exploits appeared within days, ransomware and cryptomining actors followed, and it is on CISA's KEV list. Upgrade to Jenkins 2.442 or LTS 2.426.3, which disable the feature. Because exposed controllers were scanned and read early, rotate any secrets that lived on the controller and hunt for unauthorized access rather than assuming the patch alone contains the damage.
References
- http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
- http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
- http://www.openwall.com/lists/oss-security/2024/01/24/6
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897
Related CVEs
Frequently asked questions
What is CVE-2024-23897?
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
How severe is CVE-2024-23897?
CVE-2024-23897 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2024-23897 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2024-23897?
Public advisories list the following as affected: jenkins. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-23897?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.