Jenkins CLI WebSocket Endpoint Vulnerability

CVE-2024-23898

Summary

Jenkins versions 2.217 to 2.441 and LTS versions 2.222.1 to 2.426.2 are vulnerable to a cross-site WebSocket hijacking (CSWSH) attack due to inadequate origin validation for requests made through the CLI WebSocket endpoint. This flaw enables attackers to potentially execute arbitrary CLI commands on the Jenkins controller, allowing for unauthorized access and control over the Jenkins environment. Users of affected versions are strongly advised to apply security updates to mitigate the risk associated with this vulnerability.

News Articles

GBHackers

CVE-2024-23898CVE-2024-23897

Exploit Released for Critical Jenkins RCE Flaw

Jenkins has been discovered with a critical vulnerability that is associated with arbitrary code execution that threat actors can exploit for malicious purposes.

4 months ago

The Stack

CVE-2024-23897CVE-2024-23898

Patch now: Critical Jenkins exploits released

POCs validated, over 45,000 instances still publicly exposed after critical Jenkins vulnerability disclosed.

11 months ago

References