CVE-2024-23897

CVE-2024-23897 Jenkins CVE-2024-23897: 任意文件读取漏洞导致远程代码执行 Jenkins 使用 args4j 库来解析 CLI 命令中的命令参数和选项。该命令解析器具有一个特性，当参数中包含 @ 字符后跟文件路径时，会用文件内容替换该参数（expandAtFiles）。该特性默认启用，且 Jenkins 2.441 及更早版本、LTS 2.426.2 及更早版本未禁用此功能。 这使得攻击者能够使用 Jenkins 控制器进程的默认字符编码读取 Jenkins 控制器文件系统上的任意文件。 拥有 Overall/Read 权限的攻击者可以读取完整的文件...

CVE-2024-23897

Jenkins tiene una interfaz de línea de comandos CLI integrada para acceder a Jenkins desde un script o entorno de shell. Jenkins utiliza la biblioteca args4j para analizar argumentos y opciones de comandos en el controlador de Jenkins cuando procesa comandos CLI. Este analizador de comandos tiene...

jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 This repository presents a proof-of-concept of...

CVE-2024-23897

A flaw was found in Jenkins, which uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces the "@" character followed by a file path in an argument with the file’s contents expandAtFiles...

Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character...