## https://sploitus.com/exploit?id=BED0741E-5599-552B-A2FC-1BB82FDEC7DA
# CVE-2024-23897 — HTTPS + CSRF-crumb aware PoC
`cve-2024-23897-crumb.py` — unauthenticated arbitrary file read against
Jenkins ` [file] [--http] [--port N]
python3 cve-2024-23897-crumb.py jenkins.example.com
python3 cve-2024-23897-crumb.py jenkins.example.com /etc/shells
python3 cve-2024-23897-crumb.py 10.0.0.5 /etc/passwd --http --port 8080
```
Python 3 standard library only. Read-only: sends `help "@"`; nothing is
written, uploaded, or executed.
## Extraction notes
`help` echoes a file's leading line(s) — the first line in the
`Too many arguments:` message plus following lines in the `(default: ...)`
field. Works well on files whose first line carries several fields or is long:
- `/etc/passwd`, `/etc/shells`
- `/proc/net/arp`, `/proc/net/route` (internal IPs, gateway, MACs)
- `/proc/mounts` (container/storage layout)
Files with a very short first line (e.g. `/etc/hostname`) fall through to an
auth-error path and return nothing via `help`. Whole-file extraction uses the
`connect-node` command instead, but that requires the anonymous user to hold
`Overall/Read` — often not granted, in which case the read primitive still works
but only the leading lines come back.
## Responsible use
Point it only at hosts you are authorised to test. The same channel exposes
state-changing CLI commands (`enable-job`, `reload-configuration`, …); this
script deliberately uses only the read-only `help` path.