{"uuid": "12bfefb1-2b4d-4f76-b5f2-f3cfa1ecbb40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-23897", "type": "published-proof-of-concept", "source": "https://t.me/tech_b0lt_Genona/4240", "content": "Jenkins \u0432\u044b\u043a\u0430\u0442\u0438\u043b Advisory\n\nJenkins Security Advisory 2024-01-24\nhttps://www.jenkins.io/security/advisory/2024-01-24/\n\n\u0418 \u0442\u0430\u043c \u0435\u0441\u0442\u044c \u043a\u043b\u0430\u0441\u0441\u043d\u043e\u0435\n\nArbitrary file read vulnerability through the CLI can lead to RCE\nCVE-2024-23897\nSeverity (CVSS): Critical\nThis allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.\n\n- Attackers with Overall/Read permission can read entire files.\n\n- Attackers without Overall/Read permission can read the first few lines of files. The number of lines that can be read depends on available CLI commands. As of publication of this advisory, the Jenkins security team has found ways to read the first three lines of files in recent releases of Jenkins without having any plugins installed, and has not identified any plugins that would increase this line count.\n\n\u0418 \u0435\u0441\u0442\u044c PoC \u0443\u0436\u0435 \u0442\u043e\u0436\u0435\nhttps://github.com/h4x0r-dz/CVE-2024-23897\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u043a\u043e\u043c\u0430\u043d\u0434, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 Jenkins, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0437\u0430\u043c\u0435\u043d\u0430 \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \"@\" \u043d\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430, \u0435\u0441\u043b\u0438 \u043f\u0443\u0442\u044c \u043a \u0444\u0430\u0439\u043b\u0443 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0437\u0430 \u044d\u0442\u0438\u043c \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u043c \u0432 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u042d\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Jenkins 2.441 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 LTS 2.426.2 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445, \u0438 \u0434\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0435 \u0431\u044b\u043b\u0430 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430.\n. . .\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438, \u0445\u043e\u0442\u044f \u0438 \u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438. \u0418\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c:\n\n- \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0435 URL-\u0430\u0434\u0440\u0435\u0441\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432;\n- \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 cookie-\u0444\u0430\u0439\u043b \u00ab\u0417\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c \u043c\u0435\u043d\u044f\u00bb;\n- \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e XSS-\u0430\u0442\u0430\u043a (Cross-Site Scripting, XSS) \u0447\u0435\u0440\u0435\u0437 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0441\u0431\u043e\u0440\u043a\u0438;\n- \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0445\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b CSRF (Cross-Site Request Forgery);\n- \u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0445\u0441\u044f \u0432 Jenkins;\n- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043b\u044e\u0431\u043e\u0433\u043e \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430 \u0432 Jenkins;\n- \u0417\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0434\u0430\u043c\u043f\u0430 \u043a\u0443\u0447\u0438 Java.\n\nhttps://www.securitylab.ru/news/545554.php", "creation_timestamp": "2024-01-27T12:30:14.000000Z"}