Summary:
Research Team uncovered critical vulnerabilities in Jenkins, a leading open-source automation server utilized for building, deploying, and automating software projects, plays a pivotal role in continuous integration and continuous delivery (CI/CD). The first vulnerability, tracked as CVE-2024-23897, allows unauthenticated attackers to read a limited amount of arbitrary files' data, while "read-only" authorized attackers can access entire arbitrary files from Jenkins’ server. Exploiting this flaw, attackers could potentially escalate privileges to admin and execute arbitrary code on the server. The second vulnerability, classified as high severity and tracked as CVE-2024-23898, pertains to cross-site WebSocket hijacking (CSWSH), enabling attackers to execute arbitrary CLI commands by manipulating victims into clicking on a link. In-depth analysis reveals that the vulnerabilities stem from authorization and WebSocket CLI feature flaws. Jenkins provides various authorization methods, including legacy permissions and "logged-in users can do anything" mode, which grants read permissions to all users. Additionally, the Jenkins-CLI feature, utilizing WebSocket implementation, lacks origin checks, paving the way for CSWSH attacks. The patch for CVE-2024-23897 disables the "expandAtFiles" feature, enhancing security by preventing unauthorized file access. However, mitigation strategies must address potential risks associated with WebSocket vulnerabilities, emphasizing the importance of prompt updates and robust security protocols in Jenkins deployments.[/subscribe_to_unlock_form]
Summary:
Research Team uncovered critical vulnerabilities in Jenkins, a leading open-source automation server utilized for building, deploying, and automating software projects, plays a pivotal role in continuous integration and continuous delivery (CI/CD). The first vulnerability, tracked as CVE-2024-23897, allows unauthenticated attackers to read a limited amount of arbitrary files' data, while "read-only" authorized attackers can access entire arbitrary files from Jenkins’ server. Exploiting this flaw, attackers could potentially escalate privileges to admin and execute arbitrary code on the server. The second vulnerability, classified as high severity and tracked as CVE-2024-23898, pertains to cross-site WebSocket hijacking (CSWSH), enabling attackers to execute arbitrary CLI commands by manipulating victims into clicking on a link. In-depth analysis reveals that the vulnerabilities stem from authorization and WebSocket CLI feature flaws. Jenkins provides various authorization methods, including legacy permissions and "logged-in users can do anything" mode, which grants read permissions to all users. Additionally, the Jenkins-CLI feature, utilizing WebSocket implementation, lacks origin checks, paving the way for CSWSH attacks. The patch for CVE-2024-23897 disables the "expandAtFiles" feature, enhancing security by preventing unauthorized file access. However, mitigation strategies must address potential risks associated with WebSocket vulnerabilities, emphasizing the importance of prompt updates and robust security protocols in Jenkins deployments.[emaillocker id="1283"]
Recommendations:
References:
The following reports contain further technical details:
https://securityaffairs.com/158251/hacking/cve-2024-23897-poc-exploits.html
[/emaillocker]