CVE-2024-23899 Arbitrary file read vulnerability in Git server Plugin can lead to RCE
Attackers with read permissions can read arbitrary files on the Jenkins controller due to unsafe command parser behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23899?
CVE-2024-23899 is a medium-severity path traversal vulnerability in Jenkins Git server Plugin, published on 24 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.
Weakness: CWE-22
Which versions are affected by CVE-2024-23899?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:git-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:git-server Maven | All versions | 99.101.v720e86326c09 |
org.jenkins-ci.plugins:git-server Maven | All versions | 99.101.v720e86326c09 |
Products include Jenkins Git Server.
How do I fix CVE-2024-23899?
Upgrade org.jenkins-ci.plugins:git-server to 99.101.v720e86326c09 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23899 being exploited?
There is no known exploitation of CVE-2024-23899 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Git server Plugin
Sources
Also known as GHSA-vph5-2q33-7r9h.