CVE-2024-23898: Jenkins WebSocket Hijacking RCE Vulnerability

CVE-2024-23898 Overview

CVE-2024-23898 is a cross-site WebSocket hijacking (CSWSH) vulnerability in Jenkins, the widely deployed open-source automation server. Jenkins versions 2.217 through 2.441 and LTS versions 2.222.1 through 2.426.2 fail to perform origin validation on requests sent to the Command Line Interface (CLI) WebSocket endpoint. Attackers can trick an authenticated Jenkins user into visiting a malicious page, then hijack the WebSocket connection to execute CLI commands on the Jenkins controller. The flaw maps to CWE-346 (Origin Validation Error).

Critical Impact
Successful exploitation allows attackers to run arbitrary Jenkins CLI commands as the victim user, potentially leading to code execution on the Jenkins controller and full compromise of CI/CD pipelines.

Affected Products

Jenkins weekly releases 2.217 through 2.441 (inclusive)
Jenkins LTS releases 2.222.1 through 2.426.2 (inclusive)
Jenkins instances exposing the CLI WebSocket endpoint to browsers

Discovery Timeline

2024-01-24 - Jenkins publishes Security Advisory SECURITY-3315 and releases fixed versions
2024-01-24 - CVE-2024-23898 published to NVD
2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-23898

Vulnerability Analysis

Jenkins exposes a CLI endpoint over WebSocket to allow remote command execution against the controller. Affected releases accept WebSocket upgrade requests without verifying the Origin header against an allowlist of trusted origins. Browsers attach session cookies to cross-origin WebSocket handshakes automatically, so any page a victim visits can initiate an authenticated CLI session in the background.

Once the WebSocket is established, the attacker-controlled page can send arbitrary CLI command frames and read responses. Commands execute with the privileges of the targeted Jenkins user. Administrators are particularly valuable targets because CLI commands such as groovy enable arbitrary code execution on the Jenkins controller.

The vulnerability requires user interaction. The attacker must lure an authenticated Jenkins user to a malicious or attacker-controlled web page. No additional authentication or social engineering beyond that visit is needed.

Root Cause

The CLI WebSocket handler did not enforce same-origin policy on incoming upgrade requests. WebSocket connections are not subject to the browser Same-Origin Policy in the same way as XHR or fetch, so server-side origin validation is mandatory. Its absence allowed any web page to open an authenticated channel to /cli/ws using the victim's Jenkins session cookies.

Attack Vector

An attacker hosts a page containing JavaScript that opens a WebSocket to the target Jenkins controller, for example ws://jenkins.internal/cli/ws. When an authenticated Jenkins user visits the page, the browser includes their session cookies in the handshake. The malicious script then sends CLI command frames such as who-am-i, list-jobs, or for administrators, groovy payloads that execute Java code on the controller. Refer to the SonarSource technical write-up for an in-depth walkthrough of the WebSocket hijacking primitive.

Detection Methods for CVE-2024-23898

Indicators of Compromise

WebSocket upgrade requests to /cli/ws carrying an Origin header that does not match the Jenkins controller hostname.
Unexpected execution of CLI commands such as groovy, install-plugin, or create-job from user sessions that normally interact only with the web UI.
Jenkins audit log entries showing CLI activity from users who do not typically use the CLI.
Outbound requests from Jenkins agents or controller to unfamiliar hosts shortly after CLI command execution.

Detection Strategies

Inspect reverse proxy or web server access logs for GET /cli/ws requests and correlate the Origin and Referer headers against approved Jenkins URLs.
Enable and review Jenkins audit logging (Audit Trail plugin) for CLI command invocation patterns inconsistent with user behavior.
Hunt for new or modified Jenkins jobs, credentials, or build steps following suspicious CLI sessions.

Monitoring Recommendations

Forward Jenkins controller logs, reverse proxy logs, and operating system telemetry to a centralized analytics platform for correlation.
Alert on Jenkins controller processes spawning shells, curl, wget, or compiler binaries, which often follow CLI-based code execution.
Monitor for new administrator accounts, SSH key additions, or modifications to config.xml files on the controller filesystem.

How to Mitigate CVE-2024-23898

Immediate Actions Required

Upgrade Jenkins weekly releases to 2.442 or later and LTS releases to 2.426.3 or later as documented in the Jenkins Security Advisory SECURITY-3315.
Restrict network exposure of the Jenkins controller so that browsers on untrusted networks cannot reach /cli/ws.
Rotate credentials, API tokens, and SSH keys stored in Jenkins if compromise is suspected.
Audit recent CLI activity and review job, plugin, and credential changes since January 2024.

Patch Information

Jenkins addressed the issue by enforcing origin validation on the CLI WebSocket endpoint. Fixed releases are Jenkins 2.442 (weekly) and Jenkins LTS 2.426.3. The patch is described in Jenkins Security Advisory 2024-01-24 SECURITY-3315, with additional context in the Openwall OSS-Security disclosure.

Workarounds

If upgrading immediately is not feasible, disable the CLI over WebSocket by setting the system property -Djenkins.CLI.disabled=true or by blocking access to the /cli/ws path at the reverse proxy.
Require administrators to access Jenkins only from dedicated browsers or browser profiles that do not visit untrusted sites.
Place Jenkins behind a VPN or zero-trust proxy so that authenticated sessions cannot be triggered from arbitrary internet pages.

bash

# Example NGINX snippet to block the vulnerable CLI WebSocket endpoint
location /cli/ws {
    return 403;
}

# Or enforce an Origin allowlist before proxying
map $http_origin $allowed_origin {
    default 0;
    "https://jenkins.example.com" 1;
}

location /cli/ws {
    if ($allowed_origin = 0) { return 403; }
    proxy_pass http://jenkins_upstream;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}