CVE-2024-23897: critical vulnerability in Jenkins
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJan 24
1st PoCJan 23
metasploitJan 24
CISA KEV+208d
Official alert in Brazil
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 03/2024Vulnerabilidades críticas no software Jenkinsread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
1 product (2 components)
Red Hat OpenShift Container Platform 3.11
workaround: Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3 or LTS 2.440.1…
Fixed
3 products (6 components)
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 · OpenShift Developer Tools and Services for OCP 4.12 · OpenShift Developer Tools and Services for OCP 4.13
Not affected
3 products (6 components) — because the vulnerable code is not present in the product
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 · OpenShift Developer Tools and Services for OCP 4.12 · OpenShift Developer Tools and Services for OCP 4.13
Action required by CISAfederal deadline: 2024-09-09
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
In short
Jenkins allows unauthenticated attackers to read any file on the server by using a special '@' character in CLI commands, which tells the system to load file contents instead of treating it as text.
Technical detail
The CLI argument parser in Jenkins versions 2.441 and earlier interprets '@<filepath>' syntax to load file contents, allowing unauthenticated remote file read attacks via command injection on the CLI interface. This requires network access to the Jenkins CLI port but no authentication, enabling disclosure of sensitive configuration and credential files.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Jenkins Project · Jenkinspublic PoCs found — 110
exploitdbwww.exploit-db.com/exploits/51993unverifiedgithubgithub.com/h4x0r-dz/CVE-2024-23897★ 208githubgithub.com/binganao/CVE-2024-23897★ 101githubgithub.com/wjlin0/CVE-2024-23897★ 87githubgithub.com/xaitax/CVE-2024-23897★ 83githubgithub.com/godylockz/CVE-2024-23897★ 46githubgithub.com/kaanatmacaa/CVE-2024-23897★ 23githubgithub.com/Vozec/CVE-2024-23897★ 19githubgithub.com/Maalfer/CVE-2024-23897-exploit★ 15githubgithub.com/P4x1s/CVE-2024-23897★ 15githubgithub.com/Maalfer/CVE-2024-23897★ 14githubgithub.com/verylazytech/CVE-2024-23897★ 11githubgithub.com/jenkinsci-cert/SECURITY-3314-3315★ 7githubgithub.com/yoryio/CVE-2024-23897★ 6githubgithub.com/viszsec/CVE-2024-23897★ 6githubgithub.com/10T4/PoC-Fix-jenkins-rce_CVE-2024-23897★ 5githubgithub.com/D1se0/CVE-2024-23897-Vulnerabilidad-Jenkins★ 4githubgithub.com/GraySignal/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability★ 3githubgithub.com/Praison001/CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability★ 3githubgithub.com/vmtyan/poc-cve-2024-23897★ 2githubgithub.com/Ap0dexMe0/CVE-2024-23897★ 2githubgithub.com/Fineken/Jenkins-CVE-2024-23897-Lab★ 2githubgithub.com/pulentoski/CVE-2024-23897-Arbitrary-file-read★ 1githubgithub.com/JAthulya/CVE-2024-23897★ 1githubgithub.com/AbraXa5/Jenkins-CVE-2024-23897★ 1githubgithub.com/jopraveen/CVE-2024-23897★ 1githubgithub.com/Nebian/CVE-2024-23897★ 1githubgithub.com/dheeraj-jayaswal/CICD-Goat-Vapt-Writeup★ 1githubgithub.com/murataydemir/CVE-2024-23897★ 1githubgithub.com/ifconfig-me/CVE-2024-23897★ 0githubgithub.com/brandonhjh/Jenkins-CVE-2024-23897-Exploit-Demo★ 0githubgithub.com/rivaedoardo62-boop/cve-2024-23897-jenkins-poc★ 0githubgithub.com/ShieldAuth-PHP/PBL05-CVE-Analsys★ 0githubgithub.com/Dungsocool/CVE-2024-23897★ 0githubgithub.com/razureink/cve-2024-23897-jenkins_lfi_reproduction★ 0githubgithub.com/r0xDB/CVE-2024-23897★ 0githubgithub.com/slytechroot/CVE-2024-23897★ 0githubgithub.com/B4CK4TT4CK/CVE-2024-23897★ 0githubgithub.com/WLXQqwer/Jenkins-CVE-2024-23897-★ 0githubgithub.com/ydkdk12345-bot/CVE-2024-23897-CTF★ 0githubgithub.com/foreverlanterns/secure-api-cve-2024-23897★ 0githubgithub.com/Surko888/Surko-Exploit-Jenkins-CVE-2024-23897★ 0githubgithub.com/classic130/CVE-2024-23897-Jenkins-4.441★ 0githubgithub.com/MachiavelliII/CVE-2024-23897★ 0githubgithub.com/amalpvatayam67/day03-jenkins-23897★ 0githubgithub.com/hybinn/CVE-2024-23897★ 0githubgithub.com/aadi0258/Exploit-CVE-2024-23897★ 0githubgithub.com/harekrishnarai/CVE-2024-23897-test-windows★ 0githubgithub.com/vmc8ll/poc-CVE-2024-23897★ 0githubgithub.com/w41l3r/jenkins_scan★ 0githubgithub.com/tvasari/CVE-2024-23897★ 0githubgithub.com/Alexandertanay/jenkins-cve-2024-23897-lab★ 0githubgithub.com/CyberCTF/vulhub-jenkins-cve-2024-23897★ 0githubgithub.com/cc3305/CVE-2024-23897★ 0vulncheckvulncheck.com/xdb/760dd326a1d5unverifiedvulncheckvulncheck.com/xdb/8effbe260b49unverifiedvulncheckvulncheck.com/xdb/0013389cb2b5unverifiedvulncheckvulncheck.com/xdb/cff6e613664bunverifiedvulncheckvulncheck.com/xdb/3c4a94b767cbunverifiedvulncheckvulncheck.com/xdb/d47740f112e0unverifiedcve_referencepacketstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlunverifiedcve_referencepacketstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlunverifiedvulncheckvulncheck.com/xdb/604db3e84ac2unverifiedvulncheckvulncheck.com/xdb/e7f68889c96bunverifiedvulncheckvulncheck.com/xdb/ea61ab6382c6unverifiedvulncheckvulncheck.com/xdb/6028cfd20f54unverifiedvulncheckvulncheck.com/xdb/56f0947af384unverifiedvulncheckvulncheck.com/xdb/29a3cbe431c7unverifiedvulncheckvulncheck.com/xdb/59f5833a8dd0unverifiedvulncheckvulncheck.com/xdb/020fda9d3348unverifiedvulncheckvulncheck.com/xdb/0450095821bbunverifiedvulncheckvulncheck.com/xdb/5f45754388abunverifiedvulncheckvulncheck.com/xdb/58ee3e361a9cunverifiedvulncheckvulncheck.com/xdb/4ebb59b08827unverifiedvulncheckvulncheck.com/xdb/16ccb84aebedunverifiedvulncheckvulncheck.com/xdb/9fd38a912fe1unverifiedvulncheckvulncheck.com/xdb/98fe8aa360aeunverifiedvulncheckvulncheck.com/xdb/13fbb1e454d4unverifiedvulncheckvulncheck.com/xdb/066b2623ad07unverifiedvulncheckvulncheck.com/xdb/b79e6878d0b3unverifiedvulncheckvulncheck.com/xdb/f548a7c24191unverifiedvulncheckvulncheck.com/xdb/2a862a5f18bfunverifiedvulncheckvulncheck.com/xdb/8a21c598c826unverifiedvulncheckvulncheck.com/xdb/015a1eb7b8c5unverifiedvulncheckvulncheck.com/xdb/2e81d41ecf10unverifiedvulncheckvulncheck.com/xdb/bafdcb3d292cunverifiedvulncheckvulncheck.com/xdb/45c1b452f366unverifiedvulncheckvulncheck.com/xdb/f520f4462657unverifiedvulncheckvulncheck.com/xdb/97119087d54dunverifiedvulncheckvulncheck.com/xdb/56f3efc97d5aunverifiedvulncheckvulncheck.com/xdb/f240e8d471e6unverifiedvulncheckvulncheck.com/xdb/f5619d4199d8unverifiedvulncheckvulncheck.com/xdb/20c72b87534cunverifiedvulncheckvulncheck.com/xdb/e82dc77437a5unverifiedvulncheckvulncheck.com/xdb/93fd98979e35unverifiedvulncheckvulncheck.com/xdb/8fb56cde4d69unverifiedvulncheckvulncheck.com/xdb/c79b60996775unverifiedvulncheckvulncheck.com/xdb/f917d38f15d9unverifiedvulncheckvulncheck.com/xdb/2923262d1f2bunverifiedvulncheckvulncheck.com/xdb/ecedf1c97c4dunverifiedvulncheckvulncheck.com/xdb/65d508c63f7bunverifiedvulncheckvulncheck.com/xdb/eed3068dc5a8unverifiedvulncheckvulncheck.com/xdb/57f6cf67c94bunverifiedvulncheckvulncheck.com/xdb/01299e2b815aunverifiedvulncheckvulncheck.com/xdb/0f934ed4f2f3unverifiedvulncheckvulncheck.com/xdb/6a08e72187dfunverifiedvulncheckvulncheck.com/xdb/b4eb66bed0a1unverifiedvulncheckvulncheck.com/xdb/047516873968unverifiedvulncheckvulncheck.com/xdb/ac2b1889000eunverifiedvulncheckvulncheck.com/xdb/e5f28cdbd50eunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Jenkins
In the same product, most dangerous first.
References
http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.htmlhttp://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1http://www.openwall.com/lists/oss-security/2024/01/24/6