Jenkins jitters as 45,000 servers still vulnerable to RCE attacks after patch released

The number of public-facing installs of Jenkins servers vulnerable to a recently disclosed critical vulnerability is in the tens of thousands. Scans from internet security data company Shadowserver indicate roughly 45,000 instances of the hugely popular CI/CD automation server are vulnerable to CVE-2024-23897, the critical flaw disclosed on January 24. The vast majority of exposures are contained to the US and China, with 15,806 and 11,955 vulnerable servers respectively. Trailing them are India (3,572), Germany (3,487), Republic of Korea (2,204), France (1,482), and the UK (1,179). The revelation of the vast attack surface comes days after multiple exploits were made public on January 26 – themselves released just two days after the coordinated disclosure from Jenkins and Yaniv Nizry, the researcher at Sonar who first discovered the vulnerability. It means nearly a week has passed and admins are still failing to patch against a critical vulnerability that Jenkins has warned could lead to remote code execution (RCE). While there is no hard evidence to suggest active exploitation is under way, leaving a week-long window for attackers to target vulnerable servers, all while proof-of-concept exploits are publicly available, could result in successful attacks eventually. CVE-2024-23897 is the critical vulnerability disclosed by Sonar and the main reason for Jenkins attracting so much attention from the infosec community of late, although a separate high-severity flaw was also dis...