CVE-2024-23897 – Jenkins CLI Path Traversal – What you need to know and fix now

Why this matters

If your Jenkins instance is still using the Command Line Interface (CLI) you are staring at a critical flaw – CVE-2024-23897. The vulnerability lets an unauthorised network actor read files they should not see, and in the worst case execute code on the host. Any team that runs automated pipelines, stores secrets in Jenkins or simply leaves the service exposed to the internet should treat this as an emergency.

For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.

Technical description

The NVD classifies the issue as a path‑traversal weakness in the Jenkins CLI. In plain English the CLI accepts a file path from the caller and, without proper sanitisation, concatenates it with internal directories. An attacker can therefore request files outside the intended tree by inserting “..” sequences or similar tricks.

Vulnerability class

Path traversal is a well‑known input‑validation problem. The code fails to enforce a safe root directory, so the attacker’s payload climbs up the filesystem hierarchy. The result is that the CLI can return the contents of configuration files, private keys or other artefacts that would normally be hidden.

What the flaw actually does

When a malicious client talks to the CLI endpoint it can request a file such as ../../../../etc/passwd. The server reads the file and streams it back over the same channel. Because the CLI runs with the same privileges as the Jenkins process, the attacker gains the same level of access. Limited read access is enough to discover credentials, then use those credentials to launch a second stage that runs arbitrary commands. That second stage is what the public reports describe as code execution and why ransomware groups have adopted the bug.

How to know if you are exposed

First, confirm whether the CLI feature is enabled at all. By default Jenkins ships with the CLI turned on, but many administrators disable it after the initial setup. If it is still reachable, you are in the attack surface.

Check if the CLI is reachable

From a machine that can talk to your Jenkins host, run a quick HTTP request:

curl -s -o /dev/null -w "%{http_code}\n" http://your‑jenkins:8080/cli/

A response code of 200 means the endpoint is live. Anything else – 404, 403 or a timeout – suggests it is not reachable from that network path.

Identify if the vulnerable component is present

The CLI is provided by a Java JAR file that lives in $JENKINS_HOME/war/WEB-INF/cli.jar. If that file exists, the vulnerable code is present. Verify with:

if [ -f "$JENKINS_HOME/war/WEB-INF/cli.jar" ]; then echo "CLI present"; else echo "CLI missing"; fi

Even if the JAR is present, the endpoint may be blocked by a firewall or reverse proxy. You need to check both the file and the network exposure.

Mitigation and remediation

The quickest way to stop an attacker is to stop giving them a foothold. That means either disabling the CLI or applying the vendor’s patched release. Both steps are described below.

Immediate mitigations

• Disable the CLI if you do not use it for automation. Add the flag --disable-cli to the Jenkins launch options, or set the system property jenkins.CLI.enabled=false in jenkins.xml or the appropriate init script.
• Restrict network access to the CLI port. Use a firewall rule that only allows trusted IP ranges, or place Jenkins behind a VPN.
• Remove the JAR if you are certain the feature is not needed. Deleting cli.jar prevents the endpoint from loading the vulnerable class.

These steps buy you time while you arrange a proper upgrade. They also satisfy the CISA directive that you must apply mitigations if a patch cannot be applied immediately.

Apply the official fix

The vendor has released a patched build that removes the unsafe path handling. Upgrade your Jenkins installation to the patched release for your branch. The exact version numbers are listed in the table below – you do not need to remember them, just follow the upgrade guide for your distribution and select the version marked as fixed.

After upgrading, restart the Jenkins service and verify that the version displayed on the dashboard no longer appears in the vulnerable range. Then re‑run the curl check – you should now see a 404 or a message indicating the CLI is disabled.

If you cannot patch immediately

Some organisations run Jenkins on hardware that cannot be taken down for a restart, or they rely on plugins that are not yet compatible with the newest release. In those cases:

• Keep the CLI disabled at the JVM level as described above.
• Enforce strict network segmentation – only allow the Jenkins host to talk to trusted build agents.
• Monitor Jenkins logs for any CLI‑related activity. Look for entries containing CLI or RemoteAccessException.
• Rotate any credentials that may have been stored in files readable by the CLI. Treat the situation as if an attacker could have seen them.

Even without a full upgrade, these controls reduce the chance that an attacker can move from file read to code execution.

Validate the fix

Once you have applied either the mitigation or the upgrade, run the same checks you used before:

# Verify CLI endpoint is no longer reachable
curl -s -o /dev/null -w "%{http_code}\n" http://your‑jenkins:8080/cli/

If the response is 404 or the connection is refused, the immediate risk is gone. Next, confirm the running Jenkins version does not fall in the vulnerable range by checking the “About Jenkins” page or running:

java -jar $JENKINS_HOME/war/WEB-INF/cli.jar --version

The output should match a version that appears in the “fixed” column of the table below.

What to do next

Document the steps you took, update your change‑management records and inform your security team that the CVE-2024-23897 exposure has been mitigated. Schedule a regular review of Jenkins plugins and configuration – the CLI can be re‑enabled by a careless plugin update.

Finally, keep an eye on the vendor’s security advisories. New issues can appear that affect the same component, and a disciplined patch cadence will keep your CI/CD pipeline safe.

Affected versions

Straight from the NVD record for CVE-2024-23897. If your build is inside one of these ranges, treat it as vulnerable.

Product	Affected range	Fixed in
jenkins	* up to 2.426.3	2.426.3
jenkins	* up to 2.442	2.442