CVE-2024-23897

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.442 Jenkins LTS versions prior to 2.426.3

Description Jenkins contains a flaw in its built-in Command Line Interface (CLI) due to the use of the args4j library for parsing command arguments. The parser includes a feature called expandAtFiles that is enabled by default, which replaces an @ character followed by a file path in an argument with the actual contents of that file. This allows unauthenticated attackers to read arbitrary files from the Jenkins controller file system. Attackers with Overall/Read permissions can read entire files, while those without such permissions may still read the first few lines of files depending on the available CLI commands. This issue has been exploited by ransomware groups and other threat actors to obtain cryptographic keys and sensitive data, which can be chained with other flaws to achieve remote code execution. Approximately 444,039 potentially affected instances were identified via scanning tools.

Recommendations Update Jenkins to version 2.442. Update Jenkins LTS to version 2.426.3. As a temporary workaround, disable access to the CLI to eliminate the possibility of exploitation.