<div id="primary">
		<main id="main" role="main">

		
<article id="post-252022">
	<div>
					
			<div>
				
				<p><img alt="Around 45k Jenkins servers still vulnerable to attacks due to critical flaw. Hacker in black hoodie on laptop with Jenkins butler logo image on screen and room of servers in the background." data-lazy-src="https://readwrite.com/wp-content/uploads/2024/01/Around-45k-Jenkins-servers-still-vulnerable-to-attacks-due-to-critical-flaw-825x500.png" decoding="async" height="500" src="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%20825%20500'%3E%3C/svg%3E" width="825"></img>				</p>
			</div>
			
			<div>
				

				<div>
					<p>Tens of thousands of Jenkins servers have been exposed to a high-severity bug after a patch update. This flaw enables malicious actors to execute harmful code remotely on affected systems. Around 45,000 Jenkins servers are said to be affected and open to critical remote code execution (RCE) attacks, <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-23897" rel="noopener" target="_blank">called</a> CVE-2024-23897.</p>
<blockquote data-dnt="true" data-width="500">
<p dir="ltr" lang="en">Around 45K exposed Jenkins instances vulnerable to CVE-2024-23897 (Arbitrary file read vulnerability through the CLI can lead to RCE). If you run Jenkins &amp; receive an alert from us make sure to read Jenkins advisory: <a href="https://t.co/aPPOHT1WXx">https://t.co/aPPOHT1WXx</a></p>
<p>World map: <a href="https://t.co/GNVwKGM1R9">https://t.co/GNVwKGM1R9</a> <a href="https://t.co/Zb9Do5BOi8">pic.twitter.com/Zb9Do5BOi8</a></p>
<p>— Shadowserver (@Shadowserver) <a href="https://twitter.com/Shadowserver/status/1751964510955372855?ref_src=twsrc%5Etfw">January 29, 2024</a></p></blockquote>

<p>In an advisory on the Jenkins website, it <a href="https://www.jenkins.io/security/advisory/2024-01-24/" rel="noopener" target="_blank">said</a> that the severity of the situation has been marked as critical, as it “allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.â€</p>
<p>The open source project recently issued two updates to rectify this security issue. They strongly advise users to implement these patches promptly to minimize potential risks. The automation server for the CI/CD system is used by developers as a testing stage to try different processes.</p>
<p>The Register <a href="https://www.theregister.com/2024/01/30/jenkins_rce_flaw_patch/" rel="noopener" target="_blank">reports</a> that the majority of the affected servers are located in the US and China, with counts of 15,806 and 11,955 respectively. Following these are India with 3,572 servers, Germany with 3,487, the Republic of Korea with 2,204, France with 1,482, and the UK with 1,179 vulnerable servers.</p>
<p>Despite the vulnerability being <a href="https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/" rel="noopener" target="_blank">discovered</a> by Sonar’s Vulnerability Research Team on January 24th, it remains unfixed, leaving it susceptible to potential attacks.</p>
<h2>How severe is the attack?</h2>
<p>CVE-2024-23897 is ranked at a high severity score of 9.8, which is seen to be serious. This vulnerability exploits a feature in Jenkins’ inherent command line interface (CLI), which is activated by default in versions up to and including Jenkins 2.441.</p>
<blockquote data-dnt="true" data-width="500">
<p dir="ltr" lang="en">This vulnerability in <a href="https://twitter.com/hashtag/Jenkins?src=hash&amp;ref_src=twsrc%5Etfw">#Jenkins</a> is serious CVE-2024-23897</p>
<p>POCs have been published <a href="https://t.co/nGtbf8fehd">https://t.co/nGtbf8fehd</a><a href="https://t.co/pzY0NSL5bA">https://t.co/pzY0NSL5bA</a></p>
<p>report by <a href="https://twitter.com/SonarSource?ref_src=twsrc%5Etfw">@SonarSource</a> <a href="https://t.co/VNAUg2PDN8">https://t.co/VNAUg2PDN8</a> <a href="https://t.co/vbiWGmj47M">pic.twitter.com/vbiWGmj47M</a></p>
<p>— Florian Roth (@cyb3rops) <a href="https://twitter.com/cyb3rops/status/1750835886051275057?ref_src=twsrc%5Etfw">January 26, 2024</a></p></blockquote>

<p><a href="https://www.bleepingcomputer.com/news/security/45k-jenkins-servers-exposed-to-rce-attacks-using-public-exploits/" rel="noopener" target="_blank">According</a> to BleedingComputer, there is potential for attackers to decrypt stored secrets, delete items from Jenkins servers, and download Java heap dumps. It also suggested that there had already been several possible “genuine attempts at exploitation.â€</p>
<p>In 2023, Jenkins was considered one of the <a href="https://readwrite.com/best-developer-tools/" rel="noopener" target="_blank">best developer tools of the year</a> due to its extensibility and adaptability. However, cybersecurity firm Armis has reported that <a href="https://readwrite.com/cyber-attacks-more-than-doubled-in-2023-but-businesses-remain-slow-to-act/" rel="noopener" target="_blank">cyber attacks more than doubled in 2023</a>. They warn that numerous businesses worldwide continue to underestimate the escalating threat to cybersecurity.</p>
<p><em><strong>Featured image: Canva / <a href="https://www.jenkins.io/artwork/">The Jenkins Project</a></strong></em></p>
					
					

					

					<div>
						<div>
							<p><img alt="" data-lazy-src="https://secure.gravatar.com/avatar/cda21c62d7e35cb3ae1b2a715ef88dac?s=125&amp;d=mm&amp;r=g" data-lazy-srcset="https://secure.gravatar.com/avatar/cda21c62d7e35cb3ae1b2a715ef88dac?s=250&amp;d=mm&amp;r=g 2x" decoding="async" height="125" src="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%20125%20125'%3E%3C/svg%3E" width="125"></img>							</p>
							<div>
								<h3><a href="https://readwrite.com/author/suswati-basu/">Suswati Basu</a></h3>
								<h5>
									Freelance journalist
								</h5>
								<p>
									<a href="https://www.linkedin.com/in/suswatibasu/">Suswati Basu</a> is a multilingual, award-winning editor and the founder of the intersectional literature channel, <a href="https://howtobe247.com/">How To Be Books</a>. She was shortlisted for the Guardian Mary Stott Prize and longlisted for the Guardian International Development Journalism Award.&#xD;
&#xD;
With 18 years of experience in the media industry, Suswati has held significant roles such as head of audience and deputy editor for <a href="https://www.nationalworld.com/author/suswati-basu">NationalWorld</a> news, digital editor for <a href="https://www.channel4.com/news/">Channel 4 News</a>&#xD;
 and ITV News. She has also contributed to the <a href="https://www.theguardian.com/profile/suswati-basu">Guardian</a> and received training at the <a href="https://www.bbc.com/">BBC</a> As an audience, trends, and SEO specialist, she has participated in panel events alongside Google.&#xD;
&#xD;
Her career also includes a seven-year tenure at the leading AI company <a href="https://www.dataminr.com/blog/author/suswati-basu">Dataminr</a>, where she led the Europe desk and launched the company's first employee resource group for disabilities. Before this, Suswati worked as a journalist in China for four years, investigating censorship and the Great Firewall, and acquired proficiency in several languages.&#xD;
&#xD;
In recent years, Suswati has been nominated for six awards, including the Independent Podcast Awards, International Women's Podcast Awards, and the Anthem Awards for her literary social affairs show.&#xD;
&#xD;
Her areas of speciality span a wide range, including technology, Diversity, Equity, and Inclusion (DEI), social politics, mental health, and nonfiction books.								</p>
								
							</div>
						</div>
					</div>
					
					
				</div>
			</div>
			</div>
</article>

		</main>
	</div>