Actively exploited · Published Jan 24, 2024 · Assigned by jenkins
CVE-2024-23897
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity security flaw in Jenkins from Jenkins Project. Attackers are actively exploiting it in the wild (listed by CISA on August 19, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Sep 9, 2024.
Official description
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.426.3 | GHSA-6f9g-cxwr-q5jr |
| Maven | org.jenkins-ci.main:jenkins-core | 2.440.1 | GHSA-6f9g-cxwr-q5jr |
| Maven | org.jenkins-ci.main:jenkins-core | 2.442 | GHSA-6f9g-cxwr-q5jr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins | see references |
Weakness: CWE-27 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Jenkins Security Advisory 2024-01-24 vendor-advisory
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/
- http://www.openwall.com/lists/oss-security/2024/01/24/6
- http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html
- http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html
- https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897 government-resource