CVE-2024-23897

CVE-2024-23897 由于CLI命令解析器中默认选项的配置错误，攻击者可以读取任意文件 CVE概述 Jenkins 2.441及更早版本、LTS 2.426.2及更早版本未禁用其CLI命令解析器的某个功能，该功能会将参数中'@'字符后跟文件路径的内容替换为文件内容，从而允许未经身份验证的攻击者读取Jenkins控制器文件系统上的任意文件。 受影响版本 Jenkins 2.442 Jenkins LTS Edition 2.426.3 异常情况 安全公告中说明如下： 具有Overall/Read权限的攻击者可以读取整个文件...

CVE-2024-23897-Jenkins-Arbitrary-Read-File-Vulnerability

Jenkins es un servidor de automatización de código abierto. Ayuda a automatizar las partes del desarrollo de software relacionadas con la compilación, las pruebas y el despliegue, facilitando la integración continua y la entrega continua. CVE-2024-23897 Vulnerabilidad de lectura arbitraria de...

CVE-2024-23897

CVE-2024-23897 Jenkins 2.441及更早版本、LTS 2.426.2及更早版本未禁用其CLI命令解析器的一个功能，该功能允许将参数中'@'字符后跟文件路径的内容替换为文件内容，从而允许未认证的攻击者读取Jenkins控制器文件系统上的任意文件。 利用方法 按照以下步骤执行漏洞利用： 1. 为脚本授予执行权限： root@kitploit: chmod +x runexploit.sh 2. 运行脚本： root@kitploit: ./runexploit.sh 其他参考资料 要了解有关CVE-2024-23897及其缓解措施的最新信息，请查阅以下资源： 1...

PoC-Fix-jenkins-rce_CVE-2024-23897

PoC-jenkins-rceCVE-2024-23897. 在此仓库中，你可以找到关于 CVE-2024-23897 的所有信息。 介绍 此问题被分配了 CVE 标识符 CVE-2024-23897，被描述为一种通过内置命令行接口实现的任意文件读取漏洞。该命令解析器具有一个特性，可以将参数中的 @ 字符后跟文件路径替换为该文件的内容（expandAtFiles）。此特性默认启用，并且 Jenkins 2.441 及更早版本、LTS 2.426.2 及更早版本未禁用它。 PoC 对于此 PoC，我使用 Docker 安装了 Jenkins 2.426.2 来测试该漏洞的利用。...

EUVD-2018-1008

Malware in sbrugna...

EUVD-2018-0999

Malware in sbrugna...

EUVD-2018-1304

Malware in sbrugna...

EUVD-2018-1300

Malware in sbrugna...

EUVD-2020-24748

Malware in sbrugna...

EUVD-2018-1007

Malware in sbrugna...

EUVD-2018-7246

Malware in sbrugna...

EUVD-2015-4260

Malware in sbrugna...

EUVD-2018-1017

Malware in sbrugna...

EUVD-2017-3912

Malware in sbrugna...

EUVD-2021-6595

Malicious code in bioql PyPI...

BIT-JENKINS-2024-23897

Jenkins LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system...

CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system...

Cisco NX-OS Software CLI Arbitrary Command Execution (CVE-2018-0306)

A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by...

Cisco FXOS Software and UCS Fabric Interconnect Arbitrary Code Execution (CVE-2018-0302)

A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI parser subsystem. An attacker could...

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...