Jenkins Arbitrary File Read: CVE-2024-23897 to RCE

An alert fired on the Jenkins controller for unusual CLI activity early in the morning. The controller should only receive authenticated web traffic from internal developer workstations and build agents. Before triaging anything else, establish exactly how an outside party gained the ability to interact with the server.

The anomalous CLI requests did not stop at version probing. Multiple follow-on requests read files from the controller's filesystem. Identify the specific file path that, when combined with the credentials store, allowed offline decryption of stored account passwords.

Between the file-read session and the subsequent hands-on activity, roughly two and a half hours passed. When the attacker returned, they used a different IP address and arrived with valid credentials. Identify the account used to authenticate.

With valid credentials, the attacker accessed a Jenkins capability that provides direct code execution without any additional exploit. Identify the MITRE ATT&CK technique that best describes the method used to run code on the Jenkins controller after authentication.

The attacker did not stop at the controller. The Groovy execution was used to dispatch a malicious job to the build fleet. Determine which build agent was the first to execute the attacker's payload and establish an outbound connection to external infrastructure.

The compromised build agent established a persistent outbound connection immediately after executing the dropper. Identify the external IP address it connected to.

The entire intrusion chain started from a vulnerability in how Jenkins handled one type of input. Identify the MITRE ATT&CK technique that covers an adversary extracting credentials from configuration files stored on a compromised server.