CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
Description
CVE-2024-23897 is a critical arbitrary file read vulnerability (CVSS 9.8) in Jenkins, the widely-used open-source automation server. The flaw exists in the Jenkins CLI command parser, which uses a feature that replaces an '@' character followed by a file path with the file's contents. This allows unauthenticated attackers to read arbitrary files on the Jenkins controller's file system. Affecting Jenkins versions 2.441 and earlier, and LTS versions 2.426.2 and earlier, this vulnerability has been added to CISA's KEV catalog with a confirmed ransomware association. With an extraordinary EPSS score of 94.47% (100th percentile), it is among the most exploited vulnerabilities in the global landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| jenkins | jenkins | < 2.426.3; < 2.442 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2024/01/24/6(Mailing List)
- https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314(Vendor Advisory)
- https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/(Exploit, Press/Media Coverage)
- https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897(US Government Resource)
Weakness Type
Arbitrary File Read via CLI Argument Expansion
This vulnerability exploits a feature in the args4j command-line parsing library used by Jenkins' CLI. The args4j library includes a feature where an argument starting with '@' is interpreted as a file path, and the file's contents are expanded inline as arguments. While this is a convenient feature for command-line tools, Jenkins fails to disable this behavior for its CLI interface, which is accessible to unauthenticated users. This creates an arbitrary file read condition where any file readable by the Jenkins process can be retrieved by an attacker. Arbitrary file read vulnerabilities are particularly dangerous in CI/CD systems like Jenkins because they can expose secrets, credentials, API keys, build configurations, source code, and SSH private keys that enable further compromise of the entire software delivery pipeline.
Impact Analysis
The CVSS score of 9.8 (Critical) reflects the maximum exploitability combined with high impact across all dimensions. Confidentiality impact is rated High, as attackers can read any file on the Jenkins controller accessible to the Jenkins process, including build secrets, API tokens, SSH keys, database credentials, and environment variables containing sensitive configuration. Integrity impact is rated High because the information gained from file reads — particularly cryptographic keys and credentials — can enable attackers to modify Jenkins configurations, alter build pipelines, inject malicious code into software builds, and compromise downstream systems. Availability impact is High, as attackers with sufficient access can disrupt CI/CD pipelines, destroy build artifacts, or render the Jenkins instance non-functional.
The business implications are catastrophic for organizations relying on Jenkins for software delivery. Jenkins controllers typically store credentials for source code repositories, artifact repositories, cloud providers, production deployment targets, and internal services. A single successful exploitation can cascade into a full software supply chain compromise. The EPSS score of 94.47% (100th percentile) makes this one of the most actively targeted vulnerabilities in existence. Critically, CISA has confirmed a known ransomware association, meaning ransomware groups are actively leveraging this vulnerability to gain initial access to organizations. Multiple public exploits and scanning tools are available, ensuring that any exposed Jenkins instance is under constant automated attack.
Exploit Maturity
CVE-2024-23897 represents one of the most mature and actively exploited vulnerabilities of 2024. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 9, 2024, and carries a confirmed known ransomware designation — one of the most dangerous classifications in the KEV catalog. The EPSS score of 94.47% (100th percentile) places it at the absolute highest tier of exploitation probability. Multiple public exploits are available: a scanner tool is published on Packet Storm Security, an arbitrary file read exploit is publicly available, and detailed technical analyses have been published by Sonar Source and Vicarius. The Jenkins security advisory provides official details. The combination of trivial exploitation, massive deployment base, confirmed ransomware usage, and the high-value nature of CI/CD systems makes this an emergency-level vulnerability.
Remediation
-
Upgrade Jenkins immediately — Update to Jenkins version 2.442 or later (weekly releases) or LTS version 2.426.3 or later. Download the latest release from the official Jenkins website and follow the upgrade guide for your deployment method (WAR file, package manager, Docker, or Kubernetes).
-
Disable the CLI if not actively used — As an immediate mitigation while patching is planned, disable the Jenkins CLI entirely. Navigate to Manage Jenkins > Configure Global Security and disable the CLI. Alternatively, block network access to the Jenkins CLI port through firewall rules.
-
Restrict network access to Jenkins — Ensure the Jenkins controller is not directly accessible from the internet. Implement network-level access controls to limit access to only authorized users and systems. Use a reverse proxy with authentication for any external access requirements.
-
Rotate all secrets stored in Jenkins — After patching, assume that all credentials, API keys, SSH keys, and tokens stored in Jenkins have been compromised. Rotate every credential configured in Jenkins Credential Manager, update pipeline environment variables, regenerate SSH key pairs, and revoke and reissue API tokens for all connected services.
-
Audit Jenkins logs and connected systems — Review Jenkins access logs for signs of CLI exploitation, particularly requests containing '@' followed by file paths. Check connected systems (source repositories, deployment targets, cloud providers) for unauthorized access using credentials that were stored in Jenkins. Investigate any anomalous activity in the CI/CD pipeline.
Technical Details
The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H presents the worst-case exploitability profile. Attack Vector (Network) means the CLI is remotely accessible. Attack Complexity (Low) indicates no special conditions beyond network access. Privileges Required (None) confirms that unauthenticated attackers can exploit the flaw. User Interaction (None) enables fully automated attacks. All three impact metrics are High.
The technical root cause lies in Jenkins' use of the args4j library for CLI argument parsing. The args4j library supports a convenience feature where any argument prefixed with '@' is treated as a file path — the library reads the specified file and uses its contents as the actual arguments. Jenkins exposes its CLI over HTTP (via the Jenkins-CLI endpoint) and over SSH, and this argument expansion feature is active by default. An unauthenticated attacker can send CLI commands with arguments like '@/etc/passwd' or '@/var/jenkins_home/secrets/master.key', and the args4j library will read the specified file and include its contents in the response. The amount of data returned depends on the specific CLI command used and whether the caller has certain Jenkins permissions, but even the most restricted access level can leak file content through error messages and help text. With read access to the Jenkins file system, an attacker can extract the cryptographic keys used to encrypt stored credentials, the Jenkins master.key and hudson.util.Secret files, SSH host keys, build environment configurations, and any other sensitive files accessible to the Jenkins process. This information can then be used to decrypt all stored credentials, forge authentication tokens, and achieve full remote code execution on the Jenkins controller.
Frequently Asked Questions
What is CVE-2024-23897?
CVE-2024-23897 is a critical arbitrary file read vulnerability in the Jenkins CI/CD automation server. It exploits a feature in the CLI argument parser that replaces '@' followed by a file path with the file's contents, allowing unauthenticated attackers to read any file on the Jenkins controller's file system.
Is CVE-2024-23897 being used in ransomware attacks?
Yes, CISA has confirmed a known ransomware association for this vulnerability. Ransomware operators are actively exploiting it to gain initial access to organizations through their Jenkins instances. The ability to read credentials and secrets from Jenkins provides attackers with the access needed to move laterally through the network and deploy ransomware.
What secrets can an attacker extract from Jenkins?
An attacker can potentially read any file accessible to the Jenkins process, including the cryptographic master key used to encrypt stored credentials, SSH private keys, API tokens, database passwords, cloud provider credentials, and build environment configurations. With the master key, all encrypted credentials in Jenkins can be decrypted.
Should I rotate credentials even after patching?
Absolutely. You should assume that all credentials stored in Jenkins have been compromised if you were running a vulnerable version. Rotate every credential in Jenkins Credential Manager, regenerate SSH keys, revoke API tokens, and update all passwords. The patch prevents future exploitation but does not undo any prior unauthorized file reads.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.