StatewardStateward
← All vulnerabilities
CRITICALSupply chainexploited in the wildcurated

CVE-2024-23897

Maven · org.jenkins-ci.main:jenkins-core

Summary

CVE-2024-23897 was a critical arbitrary file read vulnerability in the Jenkins automation server, identified by Sonar's Vulnerability Research and disclosed in the Jenkins security advisory on January 24, 2024, affecting Jenkins weekly up to 2.441 and LTS up to 2.426.2. Jenkins parses built-in CLI command arguments with the args4j library, whose expandAtFiles feature is enabled by default and replaces an argument that begins with an @ character followed by a file path with the contents of that file; because Jenkins never disabled this, an attacker could pass @/path/to/file as a CLI argument to make the controller read and disclose files from its filesystem. Unauthenticated attackers could read the first few lines of arbitrary files, while attackers with Overall/Read permission could read entire files, enabling theft of secrets, SSH keys, and credentials. The leaked binary secret keys could then be chained into full remote code execution by forging Remember-me cookies, abusing Resource Root URLs, bypassing CSRF protection, or decrypting stored secrets. The flaw was added to the CISA KEV catalog on August 19, 2024 and was actively exploited, including by the RansomEXX ransomware gang and the actor IntelBroker, and was linked to breaches at BORN Group and Brontoo Technology Solutions.

How to avoid it in your code

  • Patch to Jenkins weekly 2.442 or LTS 2.426.3 / 2.440.1 or later immediately.
  • Disable CLI access as a temporary workaround if patching is not possible.
  • Do not expose the Jenkins controller to the internet; restrict it to trusted networks.
  • Rotate all secrets, SSH keys, and credentials that were readable on the controller.
  • Apply least privilege to Jenkins accounts and monitor for anomalous CLI activity.

References

Related vulnerabilities

All Supply chain →