Vulnerability Analysis | Jenkins Unauthorized File Read Vulnerability (CVE-2024-23897)

Jenkins is a popular open-source continuous integration (CI) and continuous delivery (CD) tool. It helps teams automate various tasks and processes in software development, thereby improving efficiency and quality.

Jenkins has a built-in command-line interface (CLI) that allows access to Jenkins from scripts or a shell environment. Due to a defect in the function used by Jenkins to parse CLI command arguments using the args4j library, attackers can exploit this vulnerability to read arbitrary files on the Jenkins controller file system, which, combined with other functions, may lead to arbitrary code execution. Currently, the vulnerability POC has been disclosed, indicating a high risk.

▌Vulnerability Principle

Jenkins provides a command-line interface, allowing users to download a command-line client, jenkins-cli.jar, locally and invoke this client to execute some of Jenkins' features.

When users use jenkins-cli.jar, the command line is transmitted to the server side for parsing rather than being parsed inside the jenkins-cli.jar. Jenkins server uses a third-party library, args4j, to parse command-line arguments. This library implements a common feature in Linux: if an argument starts with @, it is automatically recognized as a file name, and the file content is read and used as the argument. Since Jenkins parses command-line arguments on the server side and supports this feature of args4j, it leads to a file read vulnerability. This vulnerability requires an environment variable "DEBUG=1" to be set when Jenkins starts.

▌Vulnerability Impact

Jenkins versions 2.441 and earlier.

▌Playground Environment

Docker-compose.yaml

The version of Jenkins deployed this time is 2.441.

▌Attack Process

After launching the docker environment locally, download directly from local host

You can directly use the official command-line client to download the jenkins-cli.jar file at http://localhost:8080/jnlpJars/jenkins-cli.jar.
Use jenkins-cli.jar to check the current Jenkins version, which is shown as 2.441.
When conducting an attack, there are multiple parameter attack methods, and different methods read different numbers of lines.
- The reason for this is
  - Using @ loads the file content as command-line arguments, and the whitespace characters in the file will split the arguments. For example
    - So 1, 2, 3, 4 will become 4 arguments of the help command. Since parsing command lines usually only takes the first few arguments, errors will only report these arguments, leading to only being able to read the first few lines of the file when reading.
- This method of reading is somewhat limited, so there are two methods to read the full content
- connect-node
  reload-job
- During the reading process, you need to know the absolute path. You can read according to the following steps to understand the Jenkins root directory by reading the environment variables and the CMD startup command.
  - /proc/self/environ
    /proc/self/cmdline
- Through the Jenkins root directory, proceed to read the following sensitive files.
In older versions, Jenkins user passwords are encrypted rather than hashed. Tools like jenkins-decrypt can be used to decrypt passwords.

▌Solution

Update to the latest version to resolve this vulnerability. Currently, Jenkins 2.442 and LTS 2.426.3 have disabled the relevant command parser features.

Network Access Control: Configure appropriate network firewall rules to restrict access to the Jenkins server and applications. Allow requests only from trusted IP addresses or network ranges and block unauthorized external access.

▌SecurityValidation Rules

Attack simulations targeting this vulnerability have been added to the SecurityValidation Platform. You can search for keywords "CVE-2024-23897" or "Jenkins" in the SecurityValidation Platform to obtain relevant attack simulation verification actions. This allows you to verify whether your security defense system can effectively handle this vulnerability. The platform ensures that your validation process is safe and harmless in an industry-unique manner.