CVE-2024-23897: Jenkins CLI Arbitrary File Read Leading to RCE

Jenkins includes a built-in CLI accessible over HTTP (or optionally SSH) that administrators and automation tools use to interact with the server programmatically. The CLI uses the args4j library for argument parsing. args4j includes a file expansion feature: when a command-line argument begins with @, the library reads the specified file and treats its contents as additional command-line arguments.

This feature exists in many CLI tools for passing long argument lists via file. In Jenkins, it was exposed without adequate access controls. An unauthenticated attacker could invoke any Jenkins CLI command with an @/path/to/any/file argument — Jenkins would read that file and return its first line in the resulting error message (since file contents are unlikely to be valid CLI arguments).

With certain permission levels, the full file content was readable. Critically, Jenkins' JENKINS_HOME directory contains credential stores, master key material, and configuration files that should never be externally readable.

The arbitrary file read alone is a critical finding, but the escalation path made CVE-2024-23897 exceptional:

**Credential theft**: Jenkins stores credentials in credentials.xml, encrypted with keys from secrets/master.key and secrets/hudson.util.Secret. Reading these three files and applying Jenkins' decryption logic (publicly documented) exposes every stored credential in plaintext — AWS keys, SSH private keys, API tokens, VCS passwords.

**Cryptographic key compromise**: The file secrets/slave-to-master-security-kill-switch and related paths contain private key material used in Jenkins' CLI authentication protocol. Obtaining these keys allowed forging authenticated CLI sessions.

**Deserialization RCE**: On older Jenkins instances with the remoting-based CLI enabled (deprecated but not always disabled), forged authenticated sessions could trigger Java object deserialization with attacker-controlled data — a well-known RCE primitive in Java applications.

**Groovy Script Console**: With stolen admin credentials, the Jenkins Script Console executes arbitrary Groovy code at OS level. This is the most straightforward post-credential-theft RCE path.

The full exploitation path targeting a CI/CD supply chain:

CI/CD servers are uniquely privileged systems. A Jenkins controller routinely holds access to source code repositories, cloud provider credentials for deployment, container registry push credentials, code signing certificates for production binaries, and network access to staging and production environments through build agents.

Compromising a Jenkins controller is structurally similar to a SolarWinds-style supply chain attack — the attacker gains the ability to inject malicious code into software before it reaches end users, signed by the victim organization's own certificates, delivered through trusted update mechanisms. The February 2024 CISA KEV addition reflected the high observed exploitation rate against production Jenkins servers across multiple sectors.

Detection focuses on anomalous CLI usage patterns and filesystem access:

Steps in order of urgency:

CVE-2024-23897 is the nightmare scenario for software supply chain security — an unauthenticated file read in a system that holds the credentials and build pipeline control for an organization's entire software delivery process. The path from 'read any file' to 'modify production binaries' is four steps and requires no specialized tooling beyond a Jenkins CLI client. Any organization running Jenkins must treat the January 2024 patch as an emergency update and conduct a post-incident credential audit regardless of whether active exploitation was confirmed.