QID 150784

Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.

Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature that replaces an '@' character followed by a file path in an argument with the files contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it.
This allows attackers to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.

Affected Versions:
Jenkins weekly up to and including 2.441.
Jenkins LTS up to and including LTS 2.426.2.

QID Detection Logic (Unauthenticated):
This QID detects vulnerable versions of Jenkins core from the HTTP response header.

Successful exploitation of this vulnerability could allow an unauthorized attacker to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process.