CVE-2024-43044/ Jenkins
Date of Disclosure: Aug 7th, 2024
CVE-ID and CVSS Score: CVE-2024-43044: CVSS 9.9 (Critical)
Issue Name and Description: Arbitrary file read vulnerability through agent connections can lead to RCE in Jenkins
Asset Description: Jenkins is an open-source automation and build server that is used in development environments for building, testing, and deploying software.
Vulnerability Impact: A threat actor could exploit these vulnerabilities to read arbitrary files from the file system and potentially execute arbitrary code on the affected Jenkins instances.
Exploitation Details: Jenkins uses a library for communication between controllers and agents. This library allows agents to load Java classes from the controller so that they can be executed on agents, which could be utilized to read arbitrary files from the Jenkins controller file system.
Patch Availability: Jenkins weekly can be updated to version 2.471, and Jenkins LTS can be updated to version 2.452.4 or 2.462.1
Censys Perspective:
At the time of writing, Censys observes 81,830 exposed devices online.
To identify Jenkins instances, the following Censys queries can be used:
Censys Search Query for all exposed Jenkins instances:
services.software: (product: jenkins and product: jenkins) (link)
Note that this does not pinpoint vulnerable versions.
Censys ASM query for potentially vulnerable Jenkins:
risks.name="Jenkins Vulnerability [CVE-2024-43044]" (link)
References:
