CVE
EASM
Security Advisories

Shockwave Attack Surface Management - CVE-2024-23897 Jenkins - Arbitrary file read vulnerability through the CLI

CVE
EASM
Security Advisories
Updates

CVE-2024-23897 - Arbitrary file read vulnerability through the CLI can lead to RCE

Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment.

Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.

This allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.

Remediation

Jenkins 2.442, LTS 2.426.3 disables the command parser feature that replaces an @ character followed by a file path in an argument with the file’s contents for CLI commands.

In case of problems with this fix, disable this change by setting the Java system property hudson.cli.CLICommand.allowAtSyntax to true. Doing this is strongly discouraged on any network accessible by users who are not Jenkins administrators.

Workaround:
Disabling access to the CLI is expected to prevent exploitation completely. Doing so is strongly recommended to administrators unable to immediately update to Jenkins 2.442, LTS 2.426.3. Applying this workaround does not require a Jenkins restart. For instructions, see the documentation for this workaround.

Closing Words

As always, our scanning engines has been evaluating the issue for our customers in matter of minutes after the announcement, and relevant notification were automatically sent.

Enjoyed this read?

Interested in discovering how Shockwave's Next-Gen Attack Surface Management platform can provide continuous monitoring of your external assets and identify exploitable risks? Drop your email below to stay informed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Secure Your
Externally facing
Attack Surface Today!

Subscribe using Stripe

No meetings required