CVE-2024-23898

HIGH LAB

Jenkins < 2.441 - Origin Validation Error

Title source: rule

Description

Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.

Exploits (1)

nomisec WORKING POC 2 stars

by davidmgaviria · poc

https://github.com/davidmgaviria/CVE2_Jenkins_RCE

View Code ZIP pw:eip

References (3)

[Mailing List] http://www.openwall.com/lists/oss-security/2024/01/24/6

[Vendor Advisory] https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315

[Various Sources] https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/

Scores

CVSS v3 8.8

EPSS 0.3687

EPSS Percentile 97.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY

Community Lab

docker pull jenkins/jenkins:2.441

https://github.com/davidmgaviria/CVE2_Jenkins_RCE

View in Library

Details

CWE

CWE-346

Status published

Products (3)

jenkins/jenkins 2.217 - 2.441

jenkins/jenkins 2.222.1 - 2.426.2

org.jenkins-ci.main/jenkins-core 2.217 - 2.426.3Maven

Published Jan 24, 2024

Tracked Since Feb 18, 2026