Exploits released for critical Jenkins RCE flaw, patch now

Multiple proof-of-concept (PoC) exploits for a critical Jenkins vulnerability allowing unauthenticated attackers to read arbitrary files have been made publicly available, with some researchers reporting attackers actively exploiting the flaws in attacks. Jenkins is an open-source automation server widely used in software development, particularly for Continuous Integration (CI) and Continuous Deployment (CD). It plays a critical role in automating various parts of the software development process, like building, testing, and deploying applications. It supports over a thousand integration plugins and is used by organizations of all sizes, including large enterprises. SonarSource researchers discovered two flaws in Jenkins that could enable attacks to access data in vulnerable servers and execute arbitrary CLI commands under certain conditions. The first flaw, rated critical, is CVE-2024-23897, allowing unauthenticated attackers with 'overall/read' permission to read data from arbitrary files on the Jenkins server. Attackers without this permission can still read the first few lines of files, with the number depending on the available CLI commands. The flaw stems from the default behavior of the args4j command parser in Jenkins, which automatically expands file contents into command arguments when an argument starts with the "@" character, allowing unauthorized reading of arbitrary files on the Jenkins controller file system. Sonar explained that exploitation of the particula...