Researchers found roughly 45,000 Jenkins instances exposed online that are vulnerable to CVE-2023-23897, a critical remote code execution flaw for which multiple public proof-of-concept exploits are in circulation.
Jenkins is a leading open-source automation server for CI/CD, allowing developers to streamline the building, testing, and deployment processes.
It features extensive plugin support and serves organizations of various missions and sizes.
On January 24, 2024, the project released versions 2.442 and LTS 2.426.3 to fix CVE-2023-23897, an arbitrary file read problem that can lead to executing arbitrary command-line interface commands.
This feature, enabled by default, allows attackers to read arbitrary files on the Jenkins controller's file system.
Depending on their level of permissions, attackers can exploit the flaw to access sensitive information, including the first few lines of any file or even entire files.
Depending on the instance's configuration, attackers could decrypt stored secrets, delete items from Jenkins servers, and download Java heap dumps.
Late last week, security researchers warned of multiple working exploits for CVE-2023-23897, which dramatically elevates the risk for unpatched Jenkins servers and increases the likelihood of in-the-wild exploitation.
Researchers monitoring Jenkins honeypots observed activities that resemble genuine attempts at exploitation, although there's no conclusive evidence yet.
Most of the vulnerable internet-exposed instances are in China and the United States, followed by Germany, India, France, and the UK. Shadowserver's stats represent a dire warning to Jenkins administrators, as hackers are very likely already conducting scans to find potential targets, and CVE-2023-23897 can have severe repercussions if successfully exploited.
Users unable to apply the available security updates immediately should consult the Jenkins security bulletin for mitigation recommendations and potential workarounds.
Exploits released for critical Jenkins RCE flaw, patch now.
Cisco warns of critical RCE flaw in communications software.
Critical SonicWall firewall patch not released for all devices.
Microsoft discovers critical RCE flaw in Perforce Helix Core Server.
Hackers are exploiting critical Apache Struts flaw using public PoC..
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 29 Jan 2024 22:05:10 +0000