CVE-2024-23897: Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Vulnerability summary

CVE-2024-23897 is a critical (CVSS 9.8) Path Traversal vulnerability in Jenkins Jenkins Command Line Interface (CLI). It is known to be exploited: CISA lists it, first on 19-08-2024. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 24-01-2024
   PublishedVulnerability first disclosed.
2. 19-08-2024
   Added to CISA KEVExploitedJenkins Command Line Interface (CLI) Path Traversal Vulnerability
3. 09-09-2024
   CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-27Path Traversal: 'dir/../../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.