Jenkins Command Line Interface (CLI) Path Traversal Vulnerability (CVE-2024-23897)

What is affected, what to do

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Jenkins to version 2.426.3, Jenkins to version 2.440.1, Jenkins to version 2.442. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Jenkins lt 1.606..2.426.3
• Jenkins lt 2.427..2.440.1
• Jenkins lt 2.441..2.442

Fixed in

• Jenkins 2.426.3
• Jenkins 2.440.1
• Jenkins 2.442

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade the Jenkins controller to a patched build immediately: Weekly 2.442, LTS 2.440.1, or LTS 2.426.3. Force a maintenance window — this bug is pre-auth and trivial to weaponise.
   • If patching within hours is impossible, disable the CLI feature: set the system property hudson.cli.CLICommand.allowAtSyntax=false, and block the SSH-CLI port plus the HTTP(S) /cli endpoint at the reverse proxy / firewall (typically 8080/8443 for the web UI).
   • Remove the controller from the public internet and from untrusted internal networks. Allow management only via jump host, VPN, or a dedicated admin VLAN. Have the reverse proxy drop any request to /cli or /cli/*.
   • After patching, treat every secret stored on the controller as compromised: rotate secrets/master.key, hudson.util.Secret-encrypted credentials, SSH keys, API tokens, service-account tokens, agent secrets, and any cloud credentials (AWS/Azure/GCP) referenced by jobs.
   • Audit users, admin role assignments, and API tokens; inspect users/*/config.xml for entries created or modified since January 2024 and remove unknown accounts.
   • Open an incident ticket scoped as credential exposure. If build artefacts carry personal data, evaluate the GDPR Art. 33 72-hour notification clock.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: expose the Jenkins controller only to an admin VLAN. Agents may reach the controller inbound, but do not grant the controller unrestricted outbound reach; restrict it to required SCM, registry, and cloud API endpoints.
   • WAF / reverse-proxy rule: block HTTP requests whose path matches ^/cli(/|$), especially POST with form-encoded body. Additionally drop request bodies containing CLI arguments that start with the @ character — the exact pattern the parser abuses for file inclusion.
   • Endpoint hardening: run the Jenkins process as the unprivileged jenkins user, with strict permissions on /var/lib/jenkins/secrets/, /etc/shadow, /etc/passwd and any SSH keys. Enforce an AppArmor or SELinux profile denying reads to sensitive system paths.
   • IAM and least privilege: disable anonymous read access; use matrix-based security with explicit role separation. Keep Agent-to-Controller Access Control enabled (default on 2.x). Enforce 2FA/SSO on all admin accounts.
   • Configuration baseline: pin CLI-related settings via Configuration-as-Code (JCasC) in Git and run drift detection, so a reintroduced CLI port or allowAtSyntax=true is caught quickly.
   • Backup and forensics: snapshot $JENKINS_HOME before patching so logs, audit-trail-plugin data, and secrets/ timestamps remain available for later IR work.
3. 03

   Runbook step 3

   Detection rules

   • Reverse-proxy / web access logs: POST requests to /cli or /cli?remoting=false, often in bursts with empty or scripted user agents. Sigma shape: selection: cs-uri-stem|startswith: '/cli' AND cs-method: 'POST'.
   • Jenkins access log / audit-trail plugin: CLI commands such as connect-node, help, who-am-i, enable-job executed by anonymous or unexpected users, especially with arguments beginning @/ or @C:\ — the direct path-traversal fingerprint.
   • Linux auditd on the controller: type=SYSCALL with exe=/opt/java/.../java and name=/etc/shadow, /var/lib/jenkins/secrets/master.key, or /root/.ssh/id_rsa. Any read of these paths by the Jenkins JVM is suspicious.
   • Sysmon on a Windows controller (EID 1 / EID 11): java.exe spawning cmd.exe or powershell.exe, indicating escalation from file read to RCE via the known remember-me-cookie / resource-root-URL chain.
   • Network telemetry (Zeek / Suricata): deploy ET-Open rules for CVE-2024-23897 (SID range around 2050300x) and add a custom HTTP content match for bodies containing @/etc/, @/var/lib/jenkins/secrets, or @C:\\Windows\\.
   • KQL (Sentinel / Defender XDR): DeviceProcessEvents | where InitiatingProcessFileName == "java.exe" | where FileName in~ ("sh","bash","cmd.exe","powershell.exe") | where InitiatingProcessCommandLine has "jenkins".

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Source: CSA/SingCERT, pwn.watch, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Jenkins project Jenkins
• Jenkins Project Jenkins

References & sources

• NVD (NIST)NVD: CVE-2024-23897advisory, pwn-watch
• github.comjenkinsci/jenkins/commit/554f03782057c499c49bbb06575f0d28b5200e…web
• github.comjenkinsci/jenkinspackage
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23897web, government-resource, US government resource
• jenkins.iochangelog-stableweb
• jenkins.ioJenkins Security Advisory 2024-01-24web, Vendor advisory, Vendor advisory, pwn-watch
• sonarsource.comblog/excessive-expansion-uncovering-critical-security-vulnerabi…web
• vicarius.iovsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-…web, Exploit, Third-party advisory
• packetstormsecurity.comfiles/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.h…web, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/176840/Jenkins-2.441-LTS-2.426.3-Arbitrary-File-Read.htmlweb, Exploit, Third-party advisory, Vulnerability database
• openwall.comlists/oss-security/2024/01/24/6web, Mailing list
• sonarsource.comblog/excessive-expansion-uncovering-critical-security-vulnerabi…Exploit, Press coverage
• pwn.watchpwn.watch: Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCEpwn-watch
• jenkins.ioJenkins Security Advisory 2024-01-24pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch