Security News > 2024 > January > Critical Jenkins RCE flaw exploited in the wild. Patch now! (CVE-2024-23897)
Several proof-of-concept exploits for a recently patched critical vulnerability in Jenkins have been made public and there's evidence of exploitation in the wild.
Jenkins is a widely used Java-based open-source automation server that helps developers build, test and deploy applications, enabling continuous integration and continuous delivery.
CVE-2024-23897 is an arbitrary file read vulnerability in Jenkins' built-in command line interface that could allow an unauthenticated threat actor with Overall/Read permission to read arbitrary files on the Jenkins controller file system.
The vulnerability can also be exploited to read binary files containing cryptographic keys used for various Jenkins features, he says.
PoCs for CVE-2024-23897 have been made public and could be leveraged by attackers to compromise unpatched Jenkins servers.
Both vulnerabilities have been fixed in Jenkins 2.442 and LTS 2.426.3, so Jenkins users are urged to patch as soon as possible.
News URL
https://www.helpnetsecurity.com/2024/01/29/cve-2024-23897/
Related news
- Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs (source)
- March 2024 Patch Tuesday: Microsoft fixes critical bugs in Windows Hyper-V (source)
- Fortinet warns of critical RCE bug in endpoint management software (source)
- PoC for critical Arcserve UDP vulnerabilities published (CVE-2024-0799, CVE-2024-0800) (source)
- Critical FortiClient EMS vulnerability fixed, (fake?) PoC for sale (CVE-2023-48788) (source)
- Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool (source)
- PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153) (source)
- Ivanti fixes RCE vulnerability reported by NATO cybersecurity researchers (CVE-2023-41724) (source)
- Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability (source)
- Exploit released for Fortinet RCE bug used in attacks, patch now (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-24 | CVE-2024-23897 | Unspecified vulnerability in Jenkins Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system. | 9.8 |