CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
30Exploited in Wild
YesDecision
Descriptions
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Jenkins 2.441 y anteriores, LTS 2.426.2 y anteriores no desactivan una función de su analizador de comandos CLI que reemplaza un carácter '@' seguido de una ruta de archivo en un argumento con el contenido del archivo, lo que permite a atacantes no autenticados leer archivos arbitrarios en el sistema de archivos del controlador Jenkins.
A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default; Jenkins 2.441 and earlier as well as LTS 2.426.2 and earlier do not disable it.
Jenkins version 2.441 suffers from a local file inclusion vulnerability.
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
CVSS Scores
SSVC
- Decision:Act
Timeline
- 2024-01-23 CVE Reserved
- 2024-01-24 CVE Published
- 2024-01-27 First Exploit
- 2024-08-19 CVE Updated
- 2024-08-19 Exploited in Wild
- 2024-09-09 KEV Due Date
- 2024-09-11 EPSS Updated
CWE
- CWE-27: Path Traversal: 'dir/../../filename'
- CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CAPEC
References (36)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314 | 2024-05-14 | |
| https://access.redhat.com/security/cve/CVE-2024-23897 | 2024-02-12 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2260180 | 2024-02-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Jenkins Search vendor "Jenkins" | Jenkins Search vendor "Jenkins" for product "Jenkins" | < 2.426.3 Search vendor "Jenkins" for product "Jenkins" and version " < 2.426.3" | lts |
Affected
| ||||||
| Jenkins Search vendor "Jenkins" | Jenkins Search vendor "Jenkins" for product "Jenkins" | < 2.442 Search vendor "Jenkins" for product "Jenkins" and version " < 2.442" | - |
Affected
| ||||||