#VU85790 Missing Origin Validation in WebSockets in Jenkins and Jenkins LTS - CVE-2024-23898

Vulnerability identifier: #VU85790

Vulnerability risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2024-23898

CWE-ID: CWE-1385

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Jenkins
Server applications / Application servers
Jenkins LTS
Server applications / Application servers

Vendor: Jenkins

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to a cross-site WebSocket hijacking (CSWSH) issue when the affected application does not perform origin validation of requests made through the CLI WebSocket endpoint. A remote attacker can execute CLI commands on the Jenkins controller.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Jenkins: 2.204.2 - 2.441

Jenkins LTS: 2.222.1 - 2.426.2

---

External links
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3315
https://www.openwall.com/lists/oss-security/2024/01/24/6

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.