CVE-2024-23897: Jenkins CLI Arbitrary File Read

Detection and triage

Use read-only checks to decide whether CVE-2024-23897 reaches an owned asset. Treat advisories and proof-of-concept material as evidence, never as executable instructions.

AI evidence status: This source-linked enrichment is non-authoritative and supports triage only. Verify its claims against the linked sources.

Business risk

Critical risk: an unauthenticated attacker may read arbitrary files from the Jenkins controller through the CLI parser. The Jenkins project also documents attack paths that can enable remote code execution when additional instance-specific conditions are met, including access to binary secrets and certain Jenkins features.

Source-specific exposure conditions

• Jenkins CLI access is reachable by an attacker.
• The Jenkins instance is running a weekly release up to and including 2.441, or an LTS release up to and including 2.426.2.
• The vulnerable CLI argument-parser behavior remains enabled. In affected releases, an @ character followed by a file path can be expanded to the file contents.
• The most severe impacts require additional conditions that vary by attack path, such as Overall/Read permission, enabled Resource Root URLs, reachable CLI WebSocket access, retrievable binary secrets, or control of build-log output.

Detection signals and verification

• Archive extraction, Unicode normalization, encoded separators, Windows device names, network paths, and case-insensitive filesystems.
• Symlink and time-of-check/time-of-use races between validation and file access.
• File-type decisions based only on extension or caller-supplied content type.

• Confirm the running Jenkins core version is 2.442 or later for weekly releases, or is on a fixed LTS line beginning with 2.426.3 or 2.440.1, using the administrator-visible Jenkins version information.
• Confirm that any temporary CLI-disable mitigation is active through approved administrative status or configuration review; do not validate by sending exploit-like file-expansion requests.
• Confirm that the system does not override the fix by setting hudson.cli.CLICommand.allowAtSyntax to true, unless this is an explicitly reviewed emergency exception.
• If assessing residual impact, review the Jenkins administrator System Information value for file.encoding as described by the vendor; this is risk assessment information, not a safe exploitability test.

Stop and triage

• The supplied product matches are generic Jenkins CPEs and do not identify the deployment’s exact weekly/LTS release or whether CLI access is externally reachable.
• The advisory describes several possible remote-code-execution paths but states that the list is not definitive; actual impact depends on instance configuration, permissions, secrets, plugins, and reachable endpoints.
• No deployment-specific evidence was provided for authentication configuration, Resource Root URLs, WebSocket reachability, controller operating system, character encoding, or compromise status.
• The NVD record reflects the Jenkins CNA version ranges and fixed versions, while the Jenkins advisory is the authoritative source for remediation and operational conditions.

• Stop if validation occurs only before a later path transformation or does not account for links and platform semantics.
• Switch to incident response if unexpected files, modified application content, or unauthorized reads are found.
• Do not test with sensitive system paths or production files.

Triage output: Return a reviewer-ready minimal patch with exposure evidence, authoritative fixed-version evidence, regression tests, deployed-artifact verification, rollback notes, and source links; otherwise return TRIAGE.md with the blocking decision and owner.

Evidence-linked AI claims

• Affected Product: The vulnerability affects Jenkins core CLI processing through the args4j command parser. Evidence
• Affected Version: Jenkins weekly releases up to and including 2.441 and Jenkins LTS releases up to and including 2.426.2 are affected. Evidence
• Exposure: The vulnerable parser expands an @ character followed by a file path into the file contents; attackers can read files from the Jenkins controller, with impact varying by permission and configuration. Evidence
• Fixed Version: The vendor lists Jenkins weekly 2.442, LTS 2.426.3, and LTS 2.440.1 as fixed versions. Evidence
• Remediation: Upgrade to a fixed Jenkins release; if immediate upgrading is unavailable, disable CLI access as the recommended workaround. Evidence
• Verification: Verify the running Jenkins version against the vendor's fixed release lines and review whether the allowAtSyntax override is enabled; the vendor also identifies the administrator System Information file.encoding value as relevant to assessing severe impact. Evidence
• Affected Version: The NVD CNA data records Jenkins as affected below weekly 2.442, below LTS 2.426.3 within the 2.426 line, and below LTS 2.440.1 within the 2.440 line. Evidence