CISA adds Jenkins Command Line Interface (CLI) bug to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23897 | Path Traversal in Jenkins CLI Allows File Read and Code Execution CVE-2024-23897 is a path traversal flaw in the Jenkins Command Line Interface (CLI), the built-in remote-access component of the Jenkins automation server. It is triggered when an attacker submits crafted CLI requests to a Jenkins controller, causing the CLI to resolve paths outside the intended directory and return file contents. The attacker gains limited read access to files on the controller, which can be leveraged toward code execution. Any organization running a Jenkins controller with the CLI enabled — the CLI ships with Jenkins and is commonly left on, including on internet-facing build servers — is affected. Exploitation is confirmed in the wild: the flaw is on the CISA Known Exploited Vulnerabilities catalog (added 2024-08-19) with known ransomware use, and EPSS puts its 30-day exploitation probability at 100%. Do: Upgrade Jenkins controllers to a fixed release per the vendor advisory, or apply the KEV-required mitigations — notably disabling or restricting access to the CLI — and discontinue use if mitigations are unavailable. Prioritize internet-facing Jenkins instances given known ransomware use, verify your running controller version against the advisory's fixed versions, and hunt for anomalous CLI request activity and signs of file-read reconnaissance on the controller host. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-exposed Jenkins controllers, plausibly 100,000+ total installations |
Full article477 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Jenkins Command Line Interface (CLI) bug to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability, tracked as CVE-2024-23897 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
In January 2024, researchers warned that several proof-of-concept (PoC) exploits targeting the recently disclosed critical Jenkins vulnerability, CVE-2024-23897, have been made public.
Jenkins is the most popular open source automation server, it is maintained by CloudBees and the Jenkins community. The automation server supports developers build, test and deploy their applications, it has hundreds of thousands of active installations worldwide with more than 1 million users.
The maintainers of the open-source platform have addressed nine security vulnerabilities, including a critical flaw, tracked as CVE-2024-23897, that could lead to remote code execution (RCE). The vulnerability was reported by the researcher Yaniv Nizry from Sonar who wrote a detailed analysis of the issue.
Jenkins has a built-in command line interface (CLI) to access the platform from a script or shell environment. The open-source software uses the args4j library to parse CLI command arguments and options on the Jenkins controller. The parser uses a functionality that replaces the ‘@’ character followed by a file path in an argument with the content of the file (‘expandAtFiles’). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.
An attacker can abuse the default character encoding of the Jenkins controller process to read arbitrary files on the controller file system.
An attacker with “Overall/Read” permission can read entire files, while an attacker without it can read the first three lines of the files depending on the CLI commands.
The maintainers pointed out that exploiting this flaw makes it possible to read binary files containing cryptographic keys used for various Jenkins features, even with some limitations.
The popular cyberesecurity researcher Florian Roth warned that a couple of weaponized PoC exploits have been released.
The researcher German Fernandez warned of a massive exploitation of the vulnerability, querying Shodan, he found more than 75000 internet-facing instances.
— Germán Fernández (@1ZRR4H) January 26, 2024🚨 CVE-2024-23897: Unauthenticated Arbitrary File Read vulnerability could lead to RCE on Jenkins servers.
▪ Exploits are already available.https://t.co/xreXZ88kIZ
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by September 9, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/167267/hacking/cisa-adds-jenkins-command-line-interface-cli-bug-to-its-known-exploited-vulnerabilities-catalog.html