Merges per-host detect and confirm rows into a single dataset.
CLI Confirmation
Verify if the Jenkins CLI HTTP endpoint is enabled via a GET request to /cli. Vendor Advisory
Detection
Detect fingerprints Jenkins and flags CVE-2024-23897 by version. No probe.
Summary Report
Final counts for checked, product, affected, and confirmed targets.
Target List
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Jenkins and sorts each host by whether its version falls in the CVE-2024-23897 range. CVE-2024-23897 is Jenkins CLI args4j @-file expansion that can read arbitrary files. Confirm only checks that /cli answers. It does not send a CLI command. CISA listed it on KEV after confirmed use. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page and the X-Jenkins header, reads the version, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Version flag is first. Hosts in range get a second node that GETs /cli. It does not expand an @-file or read disk.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Jenkins from the public page and X-Jenkins, then compare the version to the CVE-2024-23897 floors in the graph.
Confirm only those flagged hosts with an unauthenticated GET of /cli. It does not expand an @-file or read disk.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Jenkins was detected, the version read, the affected flag, and whether the CLI path answered.
summary.json. Counts across the list: targets, product hits, affected, confirmed, and errors.
Integrations
HTTP. Unauthenticated GET to the product root and, on flagged hosts only, /cli.
Sample output
The records below are illustrative and do not come from a real run. They show one Jenkins host inside the CVE-2024-23897 range, one patched host, and one host that is not the product.
Weekly 2.441 and earlier, LTS 2.426.2 and earlier, and LTS 2.440.0. 2.442, 2.426.3, and 2.440.1 are the floors the graph treats as not affected. The compare uses the version the product itself served.
Does a confirmed row mean a file was read?
No. Confirm only GETs /cli. It does not send a CLI command and it does not use @-file expansion. A confirmed row means the CLI HTTP surface still answers.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is an unauthenticated GET of /cli, only on hosts already in range. It does not log in or read disk.
Does the check need credentials?
No. It fingerprints the public page the way an external scanner would.
What is CVE-2024-23897?
Jenkins CLI args4j @-file expansion that can read files on the controller. CISA listed it on KEV after confirmed use. This workflow flags by version, then confirms that /cli still answers.