Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.

CVE-2024-23897(Arbitrary File Read Vulnerability) Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Affected versions: Jenkins 2.441 and earlier, LTS 2.426.2 and earlier

This exploit scans whether the provided target is vulnerable to CVE-2024-23897 and reads the file supplied, from the remote vulnerable server.

Usage: python3 CVE-2024-23897.py -u http://localhost:8888/ -f /etc/passwd

For this exploit to work, atleast one of the following conditions have to be met:

1. Legacy mode authorization is enabled.
2. Configuration “Allow anonymous read access” is checked in the “logged-in users can do anything” authorization mode.
3. The signup feature is enabled.

Note: If the exploit takes too long to complete/reads only the first few bytes of the file, terminate the exploit and run it again. Also this exploit only works if the vulnerable Jenkins instace is configured with default settings

You can also manually do the exploit with jenkins-cli.jar. To know more, refer the link below https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897

References: https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/

https://github.com/vulhub/vulhub/tree/master/jenkins/CVE-2024-23897

https://www.splunk.com/en_us/blog/security/security-insights-jenkins-cve-2024-23897-rce.html

Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited.