Outbreak Alert: Jenkins RCE Attack
| FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence.
| |
| CVE ID | CVE-2024-23897 |
| CVE Title | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system. |
| NVD Severity | CRITICAL |
| FortiRecon Severity | CRITICAL |
| FortiRecon Score | 92/100 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RansomEXX) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 4 |
| Available POC exploit(s) | 33 |
| Darknet Mention(s) | 5 (ramp, exploit) |
| Telegram Mention(s) | 7 (Ralf Hacker Channel, DragonForce Malaysia, ᴛᴇɴɢᴋᴏʀᴀᴋᴄʏʙᴇʀᴄʀᴇᴡ Official, Hunt3r Kill3rs | Охотники-убийцы, Freedom F0x) |
| FortiRecon Intelligence Reporting(s) | 13 (OSINT), 7 (Technical Intelligence), 2 (Darknet) |
| Vendor Advisory: | https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314 |
| http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html | |
| http://packetstormsecurity.com/files/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.html | |
| http://www.openwall.com/lists/oss-security/2024/01/24/6 | |
| https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/ | |
