CVE-2024-43044

Arbitrary file read in Jenkins

id: CVE-2024-43044

info:
  name: CVE-2024-43044
  author: Redflare Cyber
  reference:
     - https://www.jenkins.io/security/advisory/2024-08-07/ #advisory
     - https://github.com/convisolabs/CVE-2024-43044-jenkins #exploit
     - https://nvd.nist.gov/vuln/detail/CVE-2024-43044
  severity: high
  description: Jenkins' Remoting library enables communication between the controller and agents, allowing Java objects and plugins to be executed on agents. Vulnerabilities in versions up to 2.470 and LTS 2.452.3 allow agents and attackers with Agent/Connect permission to read arbitrary files from the controllers file system.
  tags: lfr,jenkins
  metadata:
    shodan-query: 'product:"Jenkins"'

requests:
  - method: GET
    path:
      - "{{BaseURL}}/whoAmI/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - 'X-Jenkins:'

    extractors:
      - type: regex
        part: header
        group: 1
        regex:
          # Match Jenkins versions up to 2.470 or LTS 2.452.3
          - "X-Jenkins: ((2\\.([0-3]?\\d{1,2}|4[0-6]?\\d{0,1}|470))(\\.[0-9]+)?|([0-1]?\\d{1,2})(\\.[0-9]+)?|2\\.452\\.([0-2]|3))"