Jenkins CVE-2024-23897 (CLI args4j '@' file expansion allows arbitrary file read on the controller, CISA KEV): which versions are fixed and what secrets must I rotate?

What it is: CVE-2024-23897 (Jenkins advisory SECURITY-3314, published January 24, 2024) is an arbitrary file read in the Jenkins CLI. The command parser replaced an '@' followed by a file path in an argument with the file's contents, and this was on by default. Unauthenticated users could read the first few lines of files; users with Overall/Read could read whole files. Reading secrets such as credentials and keys can be chained into further compromise. It is in CISA's KEV catalog (added August 19, 2024, ransomware use noted). Am I affected: - Jenkins weekly 2.441 and earlier, and Jenkins LTS 2.426.2 and earlier. - Check the version at the bottom of any Jenkins page or Manage Jenkins > About Jenkins. Fix: 1. Upgrade to Jenkins weekly 2.442 or LTS 2.426.3 or 2.440.1, or newer; in practice move to the current LTS. Update plugins too. 2. Short-term mitigation from the advisory: disable CLI access (no restart needed). Do not re-enable the old behavior through the hudson.cli.CLICommand.allowAtSyntax system property on any network reachable by non-administrators. 3. Put Jenkins behind authentication and a reverse proxy or VPN; do not expose the controller anonymously. 4. If an unpatched controller was reachable, assume secrets on its file system were read: rotate credentials stored in Jenkins (the credentials store, API tokens, SSH keys, cloud and registry keys, and anything in build secrets), regenerate controller secrets where possible, and review users, jobs, build logs and the script console history for unexpected changes. Check for unusual CLI requests in access logs and rebuild the controller from a clean state if you find abuse. Verify: the version shown is 2.442+/LTS 2.426.3+ (preferably current LTS), and anonymous users can't reach the CLI endpoint. Sources: https://www.jenkins.io/security/advisory/2024-01-24/ https://nvd.nist.gov/vuln/detail/CVE-2024-23897 https://www.cisa.gov/known-exploited-vulnerabilities-catalog