Critical Jenkins RCE Vulnerability (CVE-2024–23897)

Technical Details of the Jenkins RCE Vulnerability (CVE-2024–23897)

Jenkins, a widely used open-source automation server, has recently been at the center of cybersecurity discussions due to a critical vulnerability identified as CVE-2024–23897. This vulnerability presents serious security risks, particularly in the realm of remote code execution (RCE).

CVE-2024–23897: Technical details

The Jenkins RCE vulnerability, identified as CVE-2024–23897, represents a critical security flaw within the Jenkins automation server’s command-line interface (CLI).

Core Issue

• Args4j Library: Jenkins uses the args4j library for parsing command arguments in the CLI. This library has a feature where an ‘@’ character followed by a file path in a command argument is replaced with the contents of that file.
• Flaw Exploitation: The vulnerability arises when this feature is misused, allowing attackers to read arbitrary files on the Jenkins controller’s file system.

Example in one of the PoC:

python CVE-2024-23897.py -l host.txt -f /etc/passwd

Mechanism of Exploitation

• Improper Handling of ‘@’ Character: The args4j library’s handling of the ‘@’ character followed by a file path is at the heart of this vulnerability. This functionality, meant to enhance utility, becomes a security issue when exploited maliciously.
• Reading Arbitrary Files: Attackers can leverage this feature to read files that they should not have access to. This includes sensitive data and cryptographic keys, depending on the attacker’s permissions.

Permission-Based Impact

• Overall/Read Permission: Attackers with this level of permission can read entire files, gaining significant access to sensitive data.
• Limited Permission: Those without Overall/Read permission can still exploit the vulnerability but are restricted to reading only the first few lines of files.

Remote Code Execution (RCE) Threat

• Exploitation Methods: Various methods are available for attackers to execute code remotely, such as: - Using Resource Root URLs. - Crafting a “Remember me” cookie to impersonate an administrator. - Exploiting stored XSS in build logs.
• CLI WebSocket Endpoint Accessibility: Certain attack methods require access to CLI WebSocket endpoints.
• Binary Secrets Retrieval: Attackers may recover secrets stored in binary files, leading to further compromise.

Severity and Scope

• CVSS Score: The vulnerability has been assigned a CVSS score of 9.8, reflecting its high severity and critical impact.
• Affected Versions: Jenkins versions up to 2.441 and LTS versions up to 2.426.2 are affected.

Security Implications

• File Content Exposure: Unauthorized exposure of file contents, especially sensitive data and cryptographic keys.
• Variety of Attack Scenarios: The vulnerability opens up multiple avenues for attack, each with unique conditions and implications.

Affected Versions and Attack Vectors

The flaw impacts Jenkins versions up to 2.441 and LTS versions up to 2.426.2. Attackers with sufficient permissions can exploit this vulnerability to read entire files or just the first few lines, leading to different attack scenarios like RCE through Resource Root URLs, “Remember me” cookies, and stored XSS attacks in build logs.

Discovery and Public Disclosure

The vulnerability was discovered and reported by security researchers, leading to its public disclosure and highlighting the potential risks associated with unpatched Jenkins instances.

Mitigation and Patching

In response, Jenkins released patches in versions 2.442 and LTS 2.426.3, disabling the vulnerable command parser feature. Administrators are urged to update their systems immediately and, if unable, to disable Jenkins CLI access as a temporary measure.

Emergence of Proof-of-Concept Exploits

Following the disclosure, multiple Proof-of-Concept (PoC) exploits were released, increasing the urgency for administrators to secure their Jenkins instances against potential attacks.

Wider Implications and Recommendations

This incident underscores the critical importance of regular software updates and robust cybersecurity measures, especially for widely used tools like Jenkins. Organizations are advised to remain vigilant and proactive in their security practices.

Conclusion

The CVE-2024–23897 vulnerability in Jenkins serves as a stark reminder of the continuous threats in the cybersecurity landscape. Staying updated and applying recommended security measures are crucial steps in safeguarding valuable digital assets.

References:

1. “Critical Jenkins Vulnerability Exposes Servers to RCE Attacks — Patch ASAP!” The Hacker News. Source.
2. “CVE-2024–23897: Assessing the Impact of the Jenkins Arbitrary File Leak Vulnerability.” Security Boulevard. Source.
3. “CVE-2024–23897 (CVSS 9.8): Critical Jenkins Security Vulnerability, RCE Possible.” Security Online. Source.
4. “Critical Jenkins CLI File Read Vulnerability Could Lead to RCE Attacks (CVE-2024–23897).” SOCRadar. Source.
5. “Critical Jenkins Vulnerability Leads to Remote Code Execution.” SecurityWeek. Source.
6. Jenkins CLI Vulnerability CVE-2024–23897 — A Critical Path to Remote Code Execution. OP Innovate. Source.
7. https://github.com/jenkinsci/jenkins
8. https://github.com/binganao/CVE-2024-23897
9. https://www.jenkins.io/security/advisory/2024-01-24/