CVE-2024-23897

CVE-2024-23897 is a path traversal flaw in the Jenkins Command Line Interface (CLI), the built-in remote-access component of the Jenkins automation server. It is triggered when an attacker submits crafted CLI requests to a Jenkins controller, causing the CLI to resolve paths outside the intended directory and return file contents. The attacker gains limited read access to files on the controller, which can be leveraged toward code execution. Any organization running a Jenkins controller with the CLI enabled — the CLI ships with Jenkins and is commonly left on, including on internet-facing build servers — is affected. Exploitation is confirmed in the wild: the flaw is on the CISA Known Exploited Vulnerabilities catalog (added 2024-08-19) with known ransomware use, and EPSS puts its 30-day exploitation probability at 100%.

What to do: Upgrade Jenkins controllers to a fixed release per the vendor advisory, or apply the KEV-required mitigations — notably disabling or restricting access to the CLI — and discontinue use if mitigations are unavailable. Prioritize internet-facing Jenkins instances given known ransomware use, verify your running controller version against the advisory's fixed versions, and hunt for anomalous CLI request activity and signs of file-read reconnaissance on the controller host.