cve-2024-23897-jenkins_lfi_reproduction

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability CVSS 9.8 CRITICAL — Actively exploited in the wild Overview CVE-2024-23897 is a critical arbitrary file read vulnerability in Jenkins' command-line interface CLI. The Jenkins CLI uses the args4j library for parsing command arguments...

CVE2_Jenkins_RCE

Jenkins CLI Websocket Hijacking - PoC A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. This exploits targets the Jenkins CLI that can be used to remotely access and issue commands to a Jenkins control server...

cve-2024-23897-jenkins-poc

CVE-2024-23897: Jenkins Arbitrary File Read args4j @-Syntax A self-contained, fully local reproduction of CVE-2024-23897 , the critical CVSS 3.1 base score 9.8 arbitrary file read in the Jenkins CLI. The project spins up two Docker stacks that differ only by the Jenkins minor version, runs the sa...

CVE-2024-23897

Using the client The general syntax for invoking the client is as follows: java -jar jenkins-cli.jar -s JENKINSURL global options... command command options... arguments... info :- https://www.jenkins.io/doc/book/managing/cli/downloading-the-client CVE :-...

CVE-2024-23897

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Quick Start 1. Start lab docker-compose up -d 2. Wait 30s, then download CLI tool curl -O http://localhost:8080/jnlpJars/jenkins-cli.jar 3. Exploit — read /etc/passwd full file java -jar jenkins-cli.jar -s http://localhost:8080 -http connect-node...

CVE-2022-44877-RCE

This repository does not have a README...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli We have seen Jenkins File Leak / RCE CVE-2024-23897 exploited in the wild and managed to reproduce it. If your Jenkins allows anonymous users or user registration, immediately update it to the latest version. java -jar jenkins-cli.jar -s...

pwn_jenkins

Remote Code Execution Jenkins CLI arbitrary read CVE-2024-23897 applies to versions below 2.442 and LTS 2.426.3 Jenkins Advisory, Credits Authenticated, can retrieve a complete file: java -jar jenkins-cli.jar -noCertificateCheck -s https://xxx.yyy/jenkins -auth abc:abc connect-node "@/etc/passwd"...

CVE-2024-23897-Arbitrary-file-read

🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Affected versions: Jenkins 2.441 and earlier. Jenkins LTS 2.426.2 and earlier. A Python script to automate the vulnerability CVE-2024-23897 🤖 🛠️ This Python code presents a scanner for a specific vulnerability CVE-2024-23897 in Jenkins servers. It starts by...

DNS rebinding vulnerability in WebSocket CLI origin validation

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication...

org.jenkins-ci.main:jenkins-core (1.430), org.jenkins-ci.main:jenkins-test-harness (1.430) +7 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.430)

org.jenkins-ci.main:cli MAVEN version 1.430 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.430 - org.jenkins-ci.main:jenkins-test-harness 1.430 -...

org.jenkins-ci.main:jenkins-core (1.439), org.jenkins-ci.main:jenkins-test-harness (1.439) +7 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.439)

org.jenkins-ci.main:cli MAVEN version 1.439 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.439 - org.jenkins-ci.main:jenkins-test-harness 1.439 -...

org.jenkins-ci.main:jenkins-core (1.449), org.jenkins-ci.main:jenkins-test-harness (1.449) +5 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.449)

org.jenkins-ci.main:cli MAVEN version 1.449 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.449 - org.jenkins-ci.main:jenkins-test-harness 1.449 -...

org.cloudsmith.hammer.jenkins:stackhammer (1.0.0), org.jenkins-ci.main:jenkins-core (1.467) +6 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.467)

org.jenkins-ci.main:cli MAVEN version 1.467 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.cloudsmith.hammer.jenkins:stackhammer 1.0.0 - org.jenkins-ci.main:jenkins-core 1.467 -...

org.jenkins-ci.main:jenkins-core (1.531), org.jenkins-ci.main:jenkins-test-harness (1.531) +4 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.531)

org.jenkins-ci.main:cli MAVEN version 1.531 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.531 - org.jenkins-ci.main:jenkins-test-harness 1.531 -...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0, <=1.0.1), org.jenkins-ci.main:jenkins-core (1.548) +8 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.548)

org.jenkins-ci.main:cli MAVEN version 1.548 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =4.3, =4.6.1 -...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=1.3.5, <=1.4.24), org.jenkins-ci.main:jenkins-core (1.602) +3 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.602)

org.jenkins-ci.main:cli MAVEN version 1.602 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =1.3.5, =1.4.24 - org.jenkins-ci.main:jenkins-co...

com.amazonaws:codedeploy (>=1.17, <=1.23), hudson.plugins.octopusdeploy:octopusdeploy (>=1.3.0, <=1.4.0) +7 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.612)

org.jenkins-ci.main:cli MAVEN version 1.612 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.amazonaws:codedeploy =1.17, =1.3.0, =2.7.0, =1.0, =1.4 - org.jenkins-ci.plugins:ssh2easy-plugin 1.3 Source...

com.loadimpact:loadimpact-plugin (>=1.53, <=1.58), org.jenkins-ci.main:jenkins-core (1.535) +6 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.535)

org.jenkins-ci.main:cli MAVEN version 1.535 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.loadimpact:loadimpact-plugin =1.53, =1.18, =1.1, =1.2 - org.jenkins-ci.plugins:plugin 1.535 Source cves:...

org.jenkins-ci.main:jenkins-core (1.573), org.jenkins-ci.main:jenkins-test-harness (1.573) +4 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.573)

org.jenkins-ci.main:cli MAVEN version 1.573 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.573 - org.jenkins-ci.main:jenkins-test-harness 1.573 -...