This exploit script is designed to target Jenkins instances with versions <= 2.441 & <= LTS 2.426.2 affected by the CVE-2024-23897 vulnerability. The vulnerability originates from the args4j library used by Jenkins to parse command arguments and options during the processing of CLI commands on the Jenkins controller.
The script leverages the expandAtFiles feature of the command parser, which, when enabled, replaces an @ character followed by a file path in an argument with the file’s contents. This feature is enabled by default, making Jenkins vulnerable to arbitrary file reads leading to Remote Code Execution (RCE).
Attackers can exploit this vulnerability to read arbitrary files on the Jenkins controller file system, using the default character encoding of the Jenkins controller process. The script provides the flexibility to target a single URL or a list of target URLs, enabling the upload of a file to the specified server and subsequent download of the response.
For more details on the CVE-2024-23897 vulnerability, refer to the official Jenkins security advisory: Jenkins Security Advisory 2024-01-24
./exploit_script.rb -u http://example.com -f /etc/passwd./exploit_script.rb -l host_list.txt -f /etc/passwdReplace http://example.com, host_list.txt, and /etc/passwd with your actual target URL, list of target hosts, and file path.
Disclaimer: This script is provided for educational and testing purposes only. Use it responsibly and with proper authorization. The author is not responsible for any misuse or damage caused by the script.
- Author: Alexander Hagenah
- GitHub Repository: CVE-2024-23897 PoC and scanner
Contributions are welcome. Feel free to fork, modify, and make pull requests or report issues.