Information Disclosure in Jenkins Log Command Plugin by Jenkins

CVE-2024-23904

Summary

The Log Command Plugin for Jenkins versions 1.0.2 and earlier is vulnerable due to a flaw in its command parser feature. This vulnerability allows unauthenticated attackers to exploit the ability to include file paths prefixed by an '@' character. When triggered, the parser expands these paths, leading to sensitive information disclosure by reading arbitrary files from the Jenkins controller's file system. This poses a significant security risk, particularly in environments where sensitive configurations or credentials may be stored in files accessible by the plugin.

References