Threat Signal Report

Jenkins Arbitrary File Read Vulnerability (CVE-2024-23897)

What is the Vulnerability?	Cyber threat actors are actively targeting Jenkins, a Java-based open-source automation server widely used by application developers. The critical vulnerability tracked as CVE-2024-23897 could enable remote code execution (RCE) potentially leading to unauthorized access and data compromise. Exploiting this vulnerability allows attackers to read any files on the Jenkins controller file system. FortiRecon ACI service has observed recent discussions related to CVE-2024-23897 on the Dark Web. Also, a Proof of Concept (PoC) exploit has been made publicly available which makes this vulnerability crucial for continuous monitoring and exploitation activities.
What is the Vendor Solution?	Jenkins released a security advisory about this vulnerability on January 24, 2024. Jenkins Security Advisory 2024-01-24
What FortiGuard Coverage is available?	FortiGuard Labs has provided protection via the IPS signature "Jenkins.LTS.Command.Line.Interface.Arbitrary.File.Read" which was released in early February to detect and block any attack attempts targeting the vulnerability (CVE-2024-23897). FortiGuard Labs advises organizations to apply the latest Jenkins security updates and patches.