CVE-2024-23897

The Jenkins CLI command parser contains a function that automatically replaces the '@' character preceding a file path with the contents of that file. This mechanism is not disabled for unauthenticated users, allowing an attacker to craft a CLI request containing an argument in the form '@/path/to/file'. In response, the server returns the contents of the specified file from the Jenkins controller file system, without requiring any permissions.

An attacker can read any files accessible to the Jenkins process, including configuration files, SSH keys, secrets, API tokens and credentials, which can ultimately lead to complete takeover of the CI/CD environment.

Jenkins must be updated to version 2.442 or newer (weekly) or to LTS version 2.426.3 or newer. Patch details are available in the official Jenkins security advisory: https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314

Jenkins in version 2.441 and earlier; Jenkins LTS in version 2.426.2 and earlier

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.