CISA Alerts on Actively Exploited Jenkins Vulnerability Leading to Remote Code Execution: Urgent Action Required for Cybersecurity

CISA Alerts on Actively Exploited Jenkins Vulnerability Leading to Remote Code Execution: Urgent Action Required for Cybersecurity
Image credit: Bleeping Computer 

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical vulnerability in Jenkins, a widely-used open-source automation server. This vulnerability, tracked as CVE-2024-23897, has been actively exploited in cyberattacks, allowing threat actors to gain remote code execution on affected systems. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, underscoring the urgency for organizations to secure their Jenkins servers.

Flaw in Jenkins' Command Parser Enables Remote Code Execution

The CVE-2024-23897 vulnerability stems from a weakness in the args4j command parser within Jenkins. Unauthenticated attackers can exploit this flaw through the built-in command line interface (CLI) to read arbitrary files on the Jenkins controller file system. The Jenkins team explained that the command parser includes a feature, "expandAtFiles," which replaces an "@" character followed by a file path with the file's contents. This feature is enabled by default in Jenkins versions 2.441 and earlier, as well as LTS 2.426.2 and earlier, making these versions particularly vulnerable.

Widespread Impact and Exploitation of Jenkins Vulnerability

Following the release of security updates on January 24, multiple proof-of-concept (PoC) exploits were made available online. Exploitation attempts were observed just a day later, with threat monitoring service Shadowserver tracking over 28,000 exposed Jenkins instances—most located in China and the United States. While this number has decreased from the initial 45,000 unpatched servers found in January, the attack surface remains substantial, highlighting the critical need for immediate action.

Ransomware Attacks Linked to Jenkins Flaw

The CVE-2024-23897 vulnerability has been linked to several high-profile cyberattacks. A report from Trend Micro noted that exploitation in the wild began in March, while CloudSEK reported earlier this month that a threat actor named IntelBroker used the flaw to breach IT service provider BORN Group. Additionally, Juniper Networks revealed that the RansomEXX gang exploited the vulnerability in late July to breach Brontoo Technology Solutions, a company providing services to Indian banks. This attack caused significant disruptions to retail payment systems across India.

CISA's Directive and Urgent Call to Action

In response to the ongoing exploitation, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies secure their Jenkins servers against CVE-2024-23897 exploitation by September 9, as per the binding operational directive (BOD 22-01) issued in November 2021. While this directive specifically applies to federal agencies, CISA strongly advises all organizations to prioritize fixing this vulnerability to prevent potential ransomware attacks and other cyber threats.

Final Recommendations from CISA

CISA emphasized the risks posed by such vulnerabilities, noting that they are frequent attack vectors for malicious actors. The agency urged all organizations to take immediate steps to patch their systems, mitigate the vulnerability, and safeguard against the significant risks it poses to their cybersecurity infrastructure.