CVE-2024-23897 PoC — Jenkins 安全漏洞

Source

Associated Vulnerability

Description

Perform with massive Jenkins Reading-2-RCE

Readme

 # CVE-2024-23897: Jenkins Arbitrary File Read Vulnerability Leading to RCE

## Introduction

This repository contains a Python script that exploits a critical vulnerability (CVE-2024-23897) in Jenkins, leading to arbitrary file read and remote code execution (RCE). This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the target Jenkins server, potentially compromising the entire system.

## Prerequisites

Before you can use this exploit, you will need to ensure that you have the following prerequisites installed:

- Python 3 or later
- The `requests` library
- The `argparse` library
- The `colorama` library
- The `concurrent.futures` library

You can install these dependencies using the following commands:

```
pip install requests
pip install argparse
pip install colorama
pip install concurrent.futures
```

## Usage

To use this exploit, simply clone this repository and run the `CVE-2024-23897.py` script. You can specify the following options:

![Screenshot_1](https://github.com/ThatNotEasy/CVE-2024-23897/assets/25004320/ca44ccb5-983a-423d-be81-190aa67e0ce4)

- `-u, --url`: The target Jenkins URL.
- `-f, --filename`: The file containing a list of target URLs or IPs.
- `-t, --threads`: The number of threads to use for concurrent execution.
- `-o, --output`: The output file to save successful responses.
- `-c, --command`: The command to execute on the target system.

For example, to exploit a single target with the URL `http://example.com`, you would run the following command:

```
python CVE-2024-23897.py -u http://example.com
```

To exploit multiple targets from a file called `targets.txt`, you would run the following command:

```
python CVE-2024-23897.py -f targets.txt
```
![Screenshot_2](https://github.com/ThatNotEasy/CVE-2024-23897/assets/25004320/a7029f11-3c87-4689-ab73-5c4d72dd6666)

You can also specify the number of threads to use for concurrent execution using the `-t` option. For example, to use 10 threads, you would run the following command:

```
python CVE-2024-23897.py -t 10
```

If you want to save the successful responses to a file, you can specify the output file using the `-o` option.

References: @h4x0r-dz

File Snapshot

 [4.0K]  /data/pocs/2dd0e95a52adace7b4725473be11f760dfd65d08
├── [8.2K]  CVE-2024-23897.py
├── [2.1K]  README.md
└── [  27]  requirements.txt

0 directories, 3 files

Remarks