Jenkins - Path Traversal (CVE-2024-23897)
Description
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
psychologyCrowdSec Analysis
CVE-2024-23897 is a critical vulnerability in Jenkins that enables unauthenticated attackers to read arbitrary files from the Jenkins controller. This issue arises from the CLI command parser handling of arguments prefixed with an '@' character, which can lead to unauthorized disclosure of sensitive information.
CrowdSec has been tracking this vulnerability and its exploits since 26th of January 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-23897 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attack patterns relate to misuse of the Jenkins CLI feature to access files on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-01-24 |
| Rule Released | 2024-01-26 |
| CISA KEV | 2024-08-19 |
| CISA Remediation Deadline | 2024-09-09 |
| CrowdSec First Seen | 2024-12-17 |
Related Weaknesses
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.