Arbitrary File Read and Potential RCE via Jenkins CLI Argument Parser Vulnerability (CVE-2024-23897)
Executive & SecOps Summary
SECOPS ASSESSMENTJenkins weekly version 2.441 and earlier, LTS version 2.426.2 and earlier
Unauthenticated attackers can read arbitrary files on the Jenkins controller file system, potentially leading to Remote Code Execution (RCE) under specific conditions
Immediately upgrade Jenkins weekly to 2.442 or later, and LTS to 2.426.3 or later, or disable CLI access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Jenkins to a secure version (weekly 2.442+ or LTS 2.426.3+).
For Debian/Ubuntu-based systems, execute the following commands:
# Update package lists and upgrade Jenkins
sudo apt-get update
sudo apt-get --only-upgrade install jenkins
# Restart Jenkins service and verify status
sudo systemctl restart jenkins
sudo systemctl status jenkins2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, disable CLI access entirely. Run the following Groovy script in the Jenkins Script Console ('Manage Jenkins' -> 'Script Console'):
// Execute in Jenkins Script Console to disable CLI
import jenkins.model.Jenkins
import java.util.logging.Logger
def logger = Logger.getLogger('cli-disable-workaround')
def instance = Jenkins.get()
try {
instance.getDescriptor('jenkins.CLI').getApi().disableCLI()
logger.info('Jenkins CLI has been successfully disabled as a temporary workaround.')
} catch (Exception e) {
logger.severe('Failed to disable CLI: ' + e.getMessage())
}3. Log Audit & IoC Verification Commands
Audit your Jenkins access logs to identify potential exploitation attempts targeting the CLI endpoint with the '@' character.
# Search for CLI access attempts containing the '@' character in Jenkins logs
grep -i '/cli' /var/log/jenkins/jenkins.log | grep '@'
# Verify the currently running Jenkins version
curl -sI http://localhost:8080 | grep -i 'X-Jenkins'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the command-line interface (CLI) of Jenkins, specifically rooted in the default behavior of the args4j library used for parsing command arguments. By default, args4j features an expansion capability where an argument starting with the '@' character followed by a file path (e.g., '@filename') is replaced with the actual contents of that file. Jenkins did not disable this parser feature, allowing unauthenticated users to force the Jenkins controller to read arbitrary files.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker sends a specially crafted request to the Jenkins CLI endpoint (typically over HTTP or SSH) containing a CLI command with the '@' prefix pointing to a sensitive file (e.g., '/etc/passwd' or 'credentials.xml'). The args4j parser expands the file content into command arguments. When the command execution fails due to invalid arguments or syntax errors, Jenkins includes the expanded file content within the error message returned to the client, thereby leaking sensitive data.
3. Infrastructure & Business Impact
Classified with a CVSS score of 9.8 (Critical) and listed in the CISA KEV catalog, this vulnerability is actively exploited in the wild. If attackers extract cryptographic keys, credentials, or session tokens from the controller, they can compromise the entire CI/CD pipeline, leading to supply chain attacks. Furthermore, with access to specific cryptographic keys, attackers can escalate this file read capability into full Remote Code Execution (RCE) via deserialization or other administrative vectors.
Official Vendor Advisories & References
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Frequently Asked SecOps Questions (CVE-2024-23897)
FAQQ1. How critical is CVE-2024-23897 and is it actively exploited in the wild?
CVE-2024-23897 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-23897?
Primary impacted vendors include jenkins across jenkins. Scope summary: All Jenkins weekly installations <= 2.441 and LTS installations <= 2.426.2
Q3. What temporary mitigations or workarounds exist for CVE-2024-23897 before patching?
[Mitigation] Immediately upgrade Jenkins weekly to 2.442 or later, and LTS to 2.426.3 or later, or disable CLI access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-23897
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jenkins)
View Category →GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
JFrog Artifactory Path Traversal Vulnerability (CVE-2026-66384) Security Advisory: Arbitrary File Write via Docker Cache Path
[Affected Scope] JFrog Artifactory Self-Managed instances under specific remote-repository conditions
sevenz-rust2 Path Traversal and Arbitrary File Overwrite Vulnerability (CVE-2026-61725)
[Affected Scope] Rust applications utilizing sevenz-rust2 library versions prior to 0.21.1.
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.