CVE-2024-23898: High severity Jenkins Jenkins vulnerability
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Other sources
Jenkins has a built-in command line interface (CLI) to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication functionality, like HTTP Basic authentication with API tokens, or session cookies. This endpoint is enabled when running on a version of Jetty for which Jenkins supports WebSockets. This is the case when using the provided native installers, packages, or the Docker containers, as well as when running Jenkins with the command java -jar jenkins.war.
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.442 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.426.3 - Upgrade
Upgrade
redhat/Jenkinsto a version that resolves this vulnerability.Fixed in 2.442 - Upgrade
Upgrade
redhat/Jenkins LTSto a version that resolves this vulnerability.Fixed in 2.426.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23898?
CVE-2024-23898 is considered a critical vulnerability affecting Jenkins.
How do I fix CVE-2024-23898?
To fix CVE-2024-23898, update Jenkins to version 2.442 or LTS 2.426.3 or later.
Which versions of Jenkins are affected by CVE-2024-23898?
CVE-2024-23898 affects Jenkins versions 2.217 to 2.441 and LTS versions from 2.222.1 to 2.426.2.
What type of vulnerability is CVE-2024-23898?
CVE-2024-23898 is a remote code execution vulnerability in Jenkins.
Is authentication sufficient to mitigate CVE-2024-23898?
No, the default Jenkins web request authentication does not fully mitigate the risks associated with CVE-2024-23898.