CERT-In Vulnerability Note
CIVN-2024-0232
Remote code execution vulnerability in Jenkins
Original Issue Date:August 07, 2024
Severity Rating: HIGH
Software Affected
- Jenkins versions 2.441 and prior
- Jenkins LTS versions 2.426.2 and prior
Overview
A vulnerability has been reported in Jenkins which could be exploited by a remote attacker to execute arbitrary code and may result in complete compromise of the vulnerable system.
Description
Jenkins has a built-in command line interface (CLI) that allows interaction with Jenkins through scripts or shell environments. It utilizes the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. One of the features of this command parser is the expansion of an @ character followed by a file path into the contents of that file (expandAtFiles). This feature is enabled by default in Jenkins 2.441 and prior, and does not disable it in LTS 2.426.2 and prior.
A remote unauthenticated attacker could exploit this vulnerability by using the default character encoding of the Jenkins controller process. Successful exploitation of this vulnerability could allow an attacker to read arbitrary files and may result in remote code execution at the vulnerable system.
Workaround
- Disable access to the CLI
Solution
Apply appropriate updates as mentioned in Jenkins advisory:
https://www.jenkins.io/security/advisory/2024-01-24/
Vendor Information
Jenkins
https://www.jenkins.io/security/advisory/2024-01-24/
References
Jenkins
https://www.jenkins.io/security/advisory/2024-01-24/
CVE Name
CVE-2024-23897
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|