Mitigation Instructions for CVE-2024-23897

Subject: CVE-2024-23897 Jenkins XML External Entity (XXE) Vulnerability

Tech Stack:

• Jenkins

Date Issued:

• Original Date: 2024-01-24
• Last Modified Date: 2024-01-24

Criticality:

• Severity: High
• Description: This vulnerability allows remote attackers to exploit Jenkins XML parsers to read files on the server, potentially leading to sensitive information disclosure.

Overview:

• CVE-2024-23897 is an XML External Entity (XXE) vulnerability in Jenkins. It occurs because Jenkins XML parsers do not properly configure XMLInputFactory to disable external entities. This allows an attacker to craft XML data that, when parsed by Jenkins, can read files on the Jenkins server or execute external HTTP requests, leading to information disclosure and potentially remote code execution.

Attack Mechanisms:

1. XXE Injection:
   • An attacker sends specially crafted XML data to Jenkins.
2. File Read/Information Disclosure:
   • The XML parser processes the data, allowing the attacker to read sensitive files on the server.
3. External Requests:
   • The attacker can potentially force the server to make HTTP requests to external or internal services, leading to information disclosure or further exploitation.

Affected Systems:

• Jenkins versions prior to the fixed release as detailed in the Jenkins Security Advisory.

Mitigation Solution:

1. Upgrade: Upgrade to the latest version of Jenkins that has patched this vulnerability. Refer to the Jenkins Security Advisory for the fixed versions.
2. Configuration Changes: Ensure that XMLInputFactory instances in custom plugins and other components are configured to disable external entity resolution.
3. Security Best Practices: Regularly review and update Jenkins and its plugins. Implement security best practices, such as securing access to Jenkins, using least privilege principles, and conducting regular security audits.

References:

• NVD CVE-2024-23897
• GitHub Repository
• Jenkins Security Advisory