CVE-2024-23897 PoC — Jenkins 安全漏洞

Source

https://github.com/amalpvatayam67/day03-jenkins-23897

Associated Vulnerability

Title:Jenkins 安全漏洞 (CVE-2024-23897)
Description:Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Description

Jenkins CLI arbitrary file read (CVE-2024-23897)

Readme

# Day 3 — Jenkins CLI arbitrary file read (CVE-2024-23897)

**Idea:** Jenkins ≤ 2.441 (LTS ≤ 2.426.2) expands `@/path` inside CLI args.
Unauthenticated users can make Jenkins read local files and reflect their **first lines** via the CLI help output.
Fixed in 2.442 / 2.426.3.

## Build → Run

```bash
# 1) Build
docker build -t day3-jenkins-23897 .

# 2) Run
docker rm -f day3 2>/dev/null || true
docker run -d --name day3 -p 8080:8080 day3-jenkins-23897

# 3) Wait ~30–60s (first boot). Check:
curl -I http://127.0.0.1:8080/login | head -n 1

```

! If you stuck you can use ./exploit.sh (after the container is running)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!