CVE-2024-23904 Arbitrary file read vulnerability in Jenkins Log Command Plugin
Unauthenticated attackers can read arbitrary files on the Jenkins controller by exploiting a file path replacement feature in the Log Command Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23904?
CVE-2024-23904 is a high-severity path traversal vulnerability in Jenkins Log Command Plugin, published on 24 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
Weakness: CWE-22
Which versions are affected by CVE-2024-23904?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:log-command. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:log-command Maven | All versions to 1.0.2 | None |
org.jenkins-ci.plugins:log-command Maven | All versions to 1.0.2 | None |
Products include Jenkins Log Command.
How do I fix CVE-2024-23904?
No fix has been published for CVE-2024-23904 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23904 being exploited?
There is no known exploitation of CVE-2024-23904 in the wild and no public exploit code.
Sources
Also known as GHSA-qjpf-2jhx-3758.