CI/CD at Risk as Exploits Released For Critical Jenkins Bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23897 | Path Traversal in Jenkins CLI Allows File Read and Code Execution CVE-2024-23897 is a path traversal flaw in the Jenkins Command Line Interface (CLI), the built-in remote-access component of the Jenkins automation server. It is triggered when an attacker submits crafted CLI requests to a Jenkins controller, causing the CLI to resolve paths outside the intended directory and return file contents. The attacker gains limited read access to files on the controller, which can be leveraged toward code execution. Any organization running a Jenkins controller with the CLI enabled — the CLI ships with Jenkins and is commonly left on, including on internet-facing build servers — is affected. Exploitation is confirmed in the wild: the flaw is on the CISA Known Exploited Vulnerabilities catalog (added 2024-08-19) with known ransomware use, and EPSS puts its 30-day exploitation probability at 100%. Do: Upgrade Jenkins controllers to a fixed release per the vendor advisory, or apply the KEV-required mitigations — notably disabling or restricting access to the CLI — and discontinue use if mitigations are unavailable. Prioritize internet-facing Jenkins instances given known ransomware use, verify your running controller version against the advisory's fixed versions, and hunt for anomalous CLI request activity and signs of file-read reconnaissance on the controller host. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-exposed Jenkins controllers, plausibly 100,000+ total installations | |
| CVE-2024-23898 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI W Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller. NVD description · AI analysis pending | 8.8 | 67% |
| — |
Full article335 words · extracted from infosecurity-magazine.com · click to collapse
Software developers have been told to urgently patch their Jenkins servers after exploits were published for a new critical vulnerability in the product.
CVE-2024-23897 could allow unauthenticated attackers with “overall/read” permission to read arbitrary files on the Jenkins controller file system. Even those without these permissions would be able to read the first few lines of files, according to Jenkins.
“Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it,” explained the advisory.
“This allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.”
Read more on Jenkins: DevOps Alert: 12,000 Jenkins Servers Exposed to DoS Attacks
According to researchers at SonarSource, threat actors could exploit the vulnerability to read Jenkins secrets, in order to “escalate privileges to admin and eventually execute arbitrary code on the server.”
This matters, because Jenkins is described as one of the most popular open source automation server offerings widely used for building, deploying and automating software projects. It has a market share of around 44% in the Continuous Integration and Continuous Deployment (CI/CD) software space, according to SonarSource.
If an attacker could gain remote control of these developer environments, they could theoretically plant malicious code in new software builds, for use in digital supply chain attacks.
Jenkins last week released patches for both CVE-2024-23897 and another vulnerability, cross-site WebSocket hijacking bug CVE-2024-23898, as well as workarounds and more information on exploitation methods. Versions 2.442 and LTS 2.426.3 are available to fix these two bugs now.
However, Shodan searches on Friday revealed over 75,000 exposed and unpatched Jenkins servers worldwide.
Exploits were published to GitHub over the weekend.
— Dominic Alvieri (@AlvieriD) January 26, 2024
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/exploits-released-critical-jenkins/