CVE-2024-23897

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Quick Start 1. Start lab docker-compose up -d 2. Wait 30s, then download CLI tool curl -O http://localhost:8080/jnlpJars/jenkins-cli.jar 3. Exploit — read /etc/passwd full file java -jar jenkins-cli.jar -s http://localhost:8080 -http connect-node...

CVE2_Jenkins_RCE

Jenkins CLI Websocket Hijacking - PoC A proof of concept cross-site WebSocket hijacking exploit for CVE-2024-23898 — a vulnerability affecting Jenkins versions 2.217-2.441. This exploits targets the Jenkins CLI that can be used to remotely access and issue commands to a Jenkins control server...

cve-2019-1003000-jenkins-rce-poc

PoC: Jenkins RCE SECURITY-1266 / CVE-2019-1003000 Script Security, CVE-2019-1003001 Pipeline: Groovy, CVE-2019-1003002 Pipeline: Declarative A proof of concept to allow users with Overall/Read permission and Job/Configure and optional Job/Build to bypass the sandbox protection and execute arbitra...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 jenkins-cli We have seen Jenkins File Leak / RCE CVE-2024-23897 exploited in the wild and managed to reproduce it. If your Jenkins allows anonymous users or user registration, immediately update it to the latest version. java -jar jenkins-cli.jar -s...

cve-2024-23897-jenkins_lfi_reproduction

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability CVSS 9.8 CRITICAL — Actively exploited in the wild Overview CVE-2024-23897 is a critical arbitrary file read vulnerability in Jenkins' command-line interface CLI. The Jenkins CLI uses the args4j library for parsing command arguments...

CVE-2024-23897

Using the client The general syntax for invoking the client is as follows: java -jar jenkins-cli.jar -s JENKINSURL global options... command command options... arguments... info :- https://www.jenkins.io/doc/book/managing/cli/downloading-the-client CVE :-...

cve-2024-23897-jenkins-poc

CVE-2024-23897: Jenkins Arbitrary File Read args4j @-Syntax A self-contained, fully local reproduction of CVE-2024-23897 , the critical CVSS 3.1 base score 9.8 arbitrary file read in the Jenkins CLI. The project spins up two Docker stacks that differ only by the Jenkins minor version, runs the sa...

CVE-2022-44877-RCE

This repository does not have a README...

CVE-2024-23897-Arbitrary-file-read

🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Affected versions: Jenkins 2.441 and earlier. Jenkins LTS 2.426.2 and earlier. A Python script to automate the vulnerability CVE-2024-23897 🤖 🛠️ This Python code presents a scanner for a specific vulnerability CVE-2024-23897 in Jenkins servers. It starts by...

DNS rebinding vulnerability in WebSocket CLI origin validation

Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Since Jenkins 2.217 and LTS 2.222.1, one of the ways to communicate with the CLI is through a WebSocket endpoint. This endpoint relies on the default Jenkins web request authentication...

com.barchart.jenkins:maven-release-cascade (>=1.0.0, <=1.3.2), org.jenkins-ci.main:jenkins-core (1.503) +6 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.503)

org.jenkins-ci.main:cli MAVEN version 1.503 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.barchart.jenkins:maven-release-cascade =1.0.0, =1.15, =1.17 - org.jenkins-ci.plugins:plugin 1.503 Source cves...

com.xti.jenkins.plugins:aws-lambda-jenkins-plugin (0.0.1), org.jenkins-ci.main:jenkins-core (1.599) +8 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.599)

org.jenkins-ci.main:cli MAVEN version 1.599 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.xti.jenkins.plugins:aws-lambda-jenkins-plugin 0.0.1 - org.jenkins-ci.main:jenkins-core 1.599 -...

org.jenkins-ci.main:jenkins-core (1.531), org.jenkins-ci.main:jenkins-test-harness (1.531) +4 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.531)

org.jenkins-ci.main:cli MAVEN version 1.531 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.531 - org.jenkins-ci.main:jenkins-test-harness 1.531 -...

com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5), org.jenkins-ci.main:jenkins-core (1.451) +10 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.451)

org.jenkins-ci.main:cli MAVEN version 1.451 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.base2services.jenkins:github-sqs-plugin =1.0, =2.4, =1.1, =1.3 Source cves: CVE-2025-67635 Source advisory:...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=1.3.5, <=1.4.24), org.jenkins-ci.main:jenkins-core (1.602) +3 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.602)

org.jenkins-ci.main:cli MAVEN version 1.602 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =1.3.5, =1.4.24 - org.jenkins-ci.main:jenkins-co...

org.jenkins-ci.main:jenkins-core (1.573), org.jenkins-ci.main:jenkins-test-harness (1.573) +4 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.573)

org.jenkins-ci.main:cli MAVEN version 1.573 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - org.jenkins-ci.main:jenkins-core 1.573 - org.jenkins-ci.main:jenkins-test-harness 1.573 -...

jp.shiftinc.jenkins.plugins:discard-old-build (>=1.04, <=1.05), org.jenkins-ci.main:jenkins-core (1.515) +7 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.515)

org.jenkins-ci.main:cli MAVEN version 1.515 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - jp.shiftinc.jenkins.plugins:discard-old-build =1.04, =1.05 - org.jenkins-ci.main:jenkins-core 1.515 -...

com.coravy.hudson.plugins.github:github (>=1.1, <=1.8), org.jenkins-ci.main:jenkins-core (1.445) +8 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.445)

org.jenkins-ci.main:cli MAVEN version 1.445 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.coravy.hudson.plugins.github:github =1.1, =1.88, =1.1, =1.3 Source cves: CVE-2025-67635 Source advisory:...

com.amazonaws:codedeploy (>=1.17, <=1.23), hudson.plugins.octopusdeploy:octopusdeploy (>=1.3.0, <=1.4.0) +7 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.612)

org.jenkins-ci.main:cli MAVEN version 1.612 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.amazonaws:codedeploy =1.17, =1.3.0, =2.7.0, =1.0, =1.4 - org.jenkins-ci.plugins:ssh2easy-plugin 1.3 Source...

net.praqma:monkit-plugin (>=0.2.5, <=1.0.0), org.jenkins-ci.main:jenkins-core (1.426) +8 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.426)

org.jenkins-ci.main:cli MAVEN version 1.426 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - net.praqma:monkit-plugin =0.2.5, =0.1, =1.0, =1.3 Source cves: CVE-2025-67635 Source advisory:...