# CVE-2024-23897 — Jenkins CLI File Read Indicators of Compromise
# Generated by Lyrie Threat Intelligence (lyrie.ai/research)
# Date: 2026-04-25

## HTTP Request Signatures

# CLI endpoint access with @ expansion
POST /cli HTTP/1.1
POST /cli/ HTTP/1.1

# File path patterns in CLI commands
@/etc/passwd
@/etc/shadow
@/root/.ssh/id_rsa
@/home/*/.ssh/id_rsa
@/tmp/
@/var/jenkins_home/secrets/master.key
@/var/jenkins_home/secrets/hudson.util.Secret
@/var/jenkins_home/credentials.xml
@/var/jenkins_home/config.xml
@C:/Windows/System32/config/SAM
@C:/Users/*/AppData/

## Network Indicators

# Unusual CLI port access
tcp/50000 (Jenkins CLI remoting port)

# HTTP patterns
User-Agent: jenkins-cli/*
User-Agent: curl/*
User-Agent: python-urllib/*
Content-Type: application/json

## Behavioral Indicators

# Multiple CLI requests with different @<filepath> arguments (enumeration)
# Response size anomalies (large error responses indicating file leaks)
# 400 Bad Request responses with "ERROR: No such command:" containing file contents
# Rapid sequential CLI requests from same IP

## File System Indicators

# Accessed files (check Jenkins logs for file reads)
/var/jenkins_home/secrets/master.key
/var/jenkins_home/secrets/hudson.util.Secret
/var/jenkins_home/credentials.xml
/var/jenkins_home/config.xml
/etc/passwd
/etc/shadow
/root/.ssh/id_rsa
/home/*/.ssh/id_rsa

## Detection Queries

# Splunk
index=jenkins sourcetype=access_combined uri_path="/cli" uri_query="*@/*"

# Elastic/OpenSearch
http.request.uri: "/cli" AND http.request.body.content: "*@/*"

# Grep logs
grep -E 'POST /cli.*@/' /var/log/jenkins/access.log

## Mitigation Verification

# Check Jenkins version (patched = 2.442+ or LTS 2.426.3+)
# Verify CLI remoting disabled: grep "hudson.remoting.Launcher.enabled=false" /etc/default/jenkins
# Check for @ expansion blocks in logs (should see 400 responses rejecting @ prefix)
