Exploit for CVE-2024-23897

kitploit · 2026-08-28

Description

Arbitrary file read (first 3 lines) in Jenkins via jenkins-cli.jar using proxychains.

Affected Jenkins versions

Jenkins< 2.426.3, 2.442

All known vulnerabilities by product

CVSS 9.8 for CVE-2024-23897

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

100.0%higher than 100.0% of all CVEs

Updated 2026-08-30

CVE Information

Exploit Details

Modified:2026-08-28 02:12

Last Seen:2026-08-28 12:36

Reporter:KitPloit

Tags

Jenkinsjenkins-cli.jararbitrary file readproxychainsinformation disclosure

Other exploits for CVE-2024-23897

2026-08-30 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

2026-08-29 KitPloitKITPLOIT

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-TVASARI-CVE-2024-23897
Liest die ersten 3 Zeilen jeder Datei mit Leserechten für den aktuellen Benutzer auf dem System. Das Skript verwendet intern proxychains.

Verwendung: `python CVE-2024-23897.py <jenkins-cli.jar path> <target URI> <file path>`

Beispiel: `python CVE-2024-23897.py /mnt/hgfs/Share/jenkins-cli.jar http://10.10.14.8:8080/ /var/lib/jenkins/secrets/master.key`