Unauthorized File Read Vulnerability in Jenkins Git Server Plugin

CVE-2024-23899

Summary

The Jenkins Git Server Plugin is susceptible to a command parsing flaw that enables attackers with Overall/Read permissions to exploit a feature that improperly processes commands. Specifically, the vulnerability arises from the plugin's failure to restrict the '@' character, which—when followed by a file path—results in the inclusion of the file’s contents in user responses. As a consequence, an attacker can obtain unauthorized access to arbitrary files on the Jenkins controller's file system, potentially exposing sensitive information and undermining the integrity of the system.

References