Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23897 | Path Traversal in Jenkins CLI Allows File Read and Code Execution CVE-2024-23897 is a path traversal flaw in the Jenkins Command Line Interface (CLI), the built-in remote-access component of the Jenkins automation server. It is triggered when an attacker submits crafted CLI requests to a Jenkins controller, causing the CLI to resolve paths outside the intended directory and return file contents. The attacker gains limited read access to files on the controller, which can be leveraged toward code execution. Any organization running a Jenkins controller with the CLI enabled — the CLI ships with Jenkins and is commonly left on, including on internet-facing build servers — is affected. Exploitation is confirmed in the wild: the flaw is on the CISA Known Exploited Vulnerabilities catalog (added 2024-08-19) with known ransomware use, and EPSS puts its 30-day exploitation probability at 100%. Do: Upgrade Jenkins controllers to a fixed release per the vendor advisory, or apply the KEV-required mitigations — notably disabling or restricting access to the CLI — and discontinue use if mitigations are unavailable. Prioritize internet-facing Jenkins instances given known ransomware use, verify your running controller version against the advisory's fixed versions, and hunt for anomalous CLI request activity and signs of file-read reconnaissance on the controller host. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-exposed Jenkins controllers, plausibly 100,000+ total installations | |
| CVE-2024-23898 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI W Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller. NVD description · AI analysis pending | 8.8 | 67% |
| — |
Full article367 words · extracted from helpnetsecurity.com · click to collapse
Several proof-of-concept (PoC) exploits for a recently patched critical vulnerability (CVE-2024-23897) in Jenkins have been made public and there’s evidence of exploitation in the wild.
About CVE-2024-23897
Jenkins is a widely used Java-based open-source automation server that helps developers build, test and deploy applications, enabling continuous integration (CI) and continuous delivery (CD).
CVE-2024-23897 is an arbitrary file read vulnerability in Jenkins’ built-in command line interface (CLI) that could allow an unauthenticated threat actor with Overall/Read permission to read arbitrary files on the Jenkins controller file system. Those without Overall/Read permission can read the first few lines of files.
“This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller,” said penetration tester Maxime Paillé.
The vulnerability can also be exploited to read binary files containing cryptographic keys used for various Jenkins features (with some limitations), he says. Access to this sensitive information could lead to:
- Remote code execution via Resource Root URLs
- Remote code execution via “Remember me” cookie
- Remote code execution via stored cross-site scripting (XSS) attacks through build logs
- Remote code execution via CSRF protection bypass
- Decryption of secrets stored in Jenkins
- Deletion of any item in Jenkins
- Java heap dump download
Jenkins also disclosed CVE-2024-23898, a high-severity cross-site WebSocket hijacking vulnerability that could allow a threat actor to execute arbitrary CLI commands by tricking a victim to click on a malicious link.
Both vulnerabilities have been reported (and described) by SonarSource’s Vulnerability Research Team.
PoC exploits are public
PoCs for CVE-2024-23897 have been made public (1, 2) and could be leveraged by attackers to compromise unpatched Jenkins servers.
There have also been reports of the vulnerability being exploited in the wild.
Both vulnerabilities have been fixed in Jenkins 2.442 and LTS 2.426.3, so Jenkins users are urged to patch as soon as possible. Workarounds are also available.
UPDATE (January 30, 2024, 03:10 a.m. ET):
Shadowserver has found about 45,000 exposed Jenkins instances that are vulnerable to CVE-2024-23897.
UPDATE (August 14, 2024, 04:35 a.m. ET):
CVE-2024-23897 has been leveraged by the RansomEXX group to target Brontoo Technology Solutions with ransomware, and resulted in a disruption of retail payments in Indian banks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/01/29/cve-2024-23897/