CVE Series: Jenkins Arbitrary File Leak Vulnerability (CVE-2024-23897)
CVE-2024-23897 is a critical security flaw affecting Jenkins, a Java-based open-source automation server widely used for application building, testing, and deployment. It allows unauthorized access to files through the Jenkins integrated command line interface (CLI), potentially leading to remote code execution (RCE).
Course Content
CVE-2024-23897 is a critical security flaw affecting Jenkins, a Java-based open-source automation server widely used for application building, testing, and deployment. It allows unauthorized access to files through the Jenkins integrated command line interface (CLI), potentially leading to remote code execution (RCE). The vulnerability, with a CVSS score of 9.8, affects Jenkins versions up to 2.441 and LTS versions up to 2.426.2. It stems from the use of the args4j library, which can replace a file path preceded by an "@" character with the file's contents. This can be exploited to read any file on the Jenkins controller file system. In this course you’ll be exploiting and mitigating this critical CVE.
Target Audience
This course is for seasoned red teamers, penetration testers, security and vulnerability assessment analysts, developers, and system administrators who want to know how to exploit and protect against the latest vulnerabilities impacting enterprise systems.
Course Level
Intermediate
Prerequisites
Basic knowledge of the Linux command line, networking, and Python."
Helpful Links
Instructed by
Clint is a technical manager for a financial services company’s Responsible Disclosure Team, where he interacts with ethical hackers who find vulnerabilities in the company’s infrastructure. Clint is a former Special Agent with the Department of Justice where he specialized in internet investigations and conducted numerous cases on cyber threat actors on the surface, deep, and dark web, resulting in Clint earning the Attorney General’s Distinguished Service Award. Clint has trained over 1,000 law enforcement officers, prosecutors, and civilians on the dark web and dark market websites. Clint has a master’s degree in intelligence studies from American Military University where he graduated with honors and also has a master’s degree in Information Technology from Carnegie Mellon University where he graduated with highest distinction. As a former Navy Reserve Officer, Clint served in many roles, such as a division officer and department head for commands in the information warfare community.
