Critical Jenkins RCE Vulnerability (CVE-2024–23897)

The Jenkins RCE vulnerability, identified as CVE-2024–23897, represents a critical security flaw within the Jenkins automation server’s command-line interface (CLI).

Core Issue

Args4j Library: Jenkins uses the args4j library for parsing command arguments in the CLI. This library has a feature where an ‘@’ character followed by a file path in a command argument is replaced with the contents of that file.Flaw Exploitation: The vulnerability arises when this feature is misused, allowing attackers to read arbitrary files on the Jenkins controller’s file system.

Example in one of the PoC:

python CVE-2024-23897.py -l host.txt -f /etc/passwd

Mechanism of Exploitation

Improper Handling of ‘@’ Character: The args4j library’s handling of the ‘@’ character followed by a file path is at the heart of this vulnerability. This functionality, meant to enhance utility, becomes a security issue when exploited maliciously.Reading Arbitrary Files: Attackers can leverage this feature to read files that they should not have access to. This includes sensitive data and cryptographic keys, depending on the attacker’s permissions.

Permission-Based Impact

Overall/Read Permission: Attackers with this level of permission can read entire files, gaining significant access to sensitive data.Limited Permission: Those without Overall/Read permission can still exploit the vulnerability but…