CVE-2024-23897: Jenkins Arbitrary File Read via CLI Argument Parser (Pre-Auth RCE Chain)

union isfuzzy=true
(
    CommonSecurityLog
    | where DeviceProduct has_any ("Jenkins", "jenkins")
    | where RequestURL has "/cli" or RequestURL has "remoting"
    | where RequestMethod == "POST"
    | where RequestURL matches regex @"cli.*@\.\./|cli.*@/etc/|cli.*@/var/jenkins"
    | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, RequestMethod, Activity, AdditionalExtensions
),
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog" or Category == "FrontdoorAccessLog"
    | where requestUri_s has "/cli" or requestUri_s has "remoting"
    | where httpMethod_s == "POST"
    | where requestUri_s matches regex @"@[./]"
    | project TimeGenerated, Resource, clientIP_s, requestUri_s, httpMethod_s, httpStatus_d, userAgent_s
),
(
    W3CIISLog
    | where csUriStem has "/cli"
    | where csMethod == "POST"
    | where csUriQuery has "@" and (csUriQuery has ".." or csUriQuery has "/etc/" or csUriQuery has "passwd" or csUriQuery has "secret")
    | project TimeGenerated, sSiteName, sIP, cIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent
),
(
    SecurityAlert
    | where ProductName has_any ("Jenkins", "Defender for DevOps")
    | where AlertName has_any ("file read", "path traversal", "CLI", "CVE-2024-23897")
    | project TimeGenerated, AlertName, AlertSeverity, Description, Entities, RemediationSteps
)
| extend CVE = "CVE-2024-23897"
| sort by TimeGenerated desc

index=* sourcetype IN ("access_combined", "apache:access", "nginx:plus:kv", "iis", "pan:traffic", "cisco:asa", "suricata", "zeek:http")
| eval uri=coalesce(uri, cs_uri_stem, request, url)
| eval method=coalesce(method, cs_method, http_method)
| eval src_ip=coalesce(src_ip, c_ip, clientip, src)
| where (match(uri, "/cli") OR match(uri, "remoting/legacy"))
  AND (method="POST" OR method="GET")
  AND (
        match(uri, "@\.\./") OR match(uri, "@/etc/") OR match(uri, "@/var/jenkins") OR
        match(uri, "@/root") OR match(uri, "@.*secret") OR match(uri, "@.*passwd") OR
        match(uri, "@.*credentials") OR match(uri, "@.*id_rsa")
      )
| eval cve="CVE-2024-23897"
| eval severity="critical"
| stats count AS attempt_count, values(uri) AS uris, values(method) AS methods, dc(uri) AS unique_paths
    BY src_ip, dest, cve, severity, sourcetype
| where attempt_count >= 1
| eval risk_score=case(
    attempt_count >= 10, 100,
    attempt_count >= 3, 85,
    true(), 70
  )
| sort - risk_score

sequence by source.ip with maxspan=5m
  [network where
    destination.port in (8080, 8443, 443, 80) and
    http.request.method in ("POST", "GET") and
    (
      wildcard(url.path, "*/cli*") or
      wildcard(url.path, "*/remoting/legacy*")
    ) and
    (
      wildcard(url.query, "*@../*") or
      wildcard(url.query, "*@/etc/*") or
      wildcard(url.query, "*@/root*") or
      wildcard(url.query, "*@*secret*") or
      wildcard(url.query, "*@*passwd*") or
      wildcard(url.query, "*@*credentials*") or
      wildcard(url.query, "*@*id_rsa*")
    )
  ]
  [network where
    http.response.status_code in (200, 201, 500) and
    (
      wildcard(url.path, "*/cli*") or
      wildcard(url.path, "*/remoting/legacy*")
    )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  'CVE-2024-23897' AS cve_id,
  'critical' AS severity,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  "username",
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'NGINX', 'Microsoft IIS', 'Palo Alto Networks Firewall', 'Cisco ASA', 'Snort')
  AND (
    URL ILIKE '%/cli%'
    OR URL ILIKE '%/remoting/legacy%'
  )
  AND (
    URL ILIKE '%@../%'
    OR URL ILIKE '%@/etc/%'
    OR URL ILIKE '%@/root%'
    OR URL ILIKE '%@%secret%'
    OR URL ILIKE '%@%passwd%'
    OR URL ILIKE '%@%credential%'
    OR URL ILIKE '%@%id_rsa%'
  )
  AND LAST 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=*jenkins* OR _sourceCategory=*web/access* OR _sourceCategory=*nginx* OR _sourceCategory=*apache* OR _sourceCategory=*iis*
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "\"(?<method>GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH) (?<uri>[^\s]+)" nodrop
| parse regex "\s(?<status_code>\d{3})\s" nodrop
| where (uri matches "/cli*" or uri matches "*/remoting/legacy*")
  and (
    uri matches "*@../*"
    or uri matches "*@/etc/*"
    or uri matches "*@/root*"
    or uri matches "*@*secret*"
    or uri matches "*@*passwd*"
    or uri matches "*@*credential*"
    or uri matches "*@*id_rsa*"
  )
| eval cve = "CVE-2024-23897"
| eval risk = if(method == "POST", "high", "medium")
| count as hit_count by src_ip, uri, method, status_code, cve, risk
| sort by hit_count desc

rule cve_2024_23897_jenkins_file_read {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-23897 Jenkins CLI arbitrary file read exploitation attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314"
    cve = "CVE-2024-23897"
    mitre_attack_tactic = "Initial Access, Credential Access"
    mitre_attack_technique = "T1190, T1083, T1552"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /POST|GET/
    (
      $http.network.http.request_uri = /\/cli/ or
      $http.network.http.request_uri = /\/remoting\/legacy/
    )
    (
      $http.network.http.request_uri = /@\.\.\// or
      $http.network.http.request_uri = /@\/etc\// or
      $http.network.http.request_uri = /@\/root/ or
      $http.network.http.request_uri = /@.*secret/ or
      $http.network.http.request_uri = /@.*passwd/ or
      $http.network.http.request_uri = /@.*credential/ or
      $http.network.http.request_uri = /@.*id_rsa/
    )

  match:
    $http.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($http.network.http.response_code = 200, 95,
      if($http.network.http.response_code = 500, 70, 60))
    )
    $attacker_ip = array_distinct($http.principal.ip)
    $target_uri = array_distinct($http.network.http.request_uri)

  condition:
    $http
}

#event_simpleName=NetworkListenPort83 OR #event_simpleName=NetworkReceiveAcceptIP4
| filter LocalPort in (8080, 8443, 443, 80)
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | filter ImageFileName matches /jenkins/
    | filter (CommandLine matches /@\.\.\// or CommandLine matches /@\/etc\// or CommandLine matches /@.*secret/ or CommandLine matches /@.*passwd/ or CommandLine matches /@.*credential/ or CommandLine matches /@.*id_rsa/)
    | fields aid, TargetProcessId, CommandLine, ImageFileName, ParentImageFileName, UserName, SHA256HashData
  ]
  on aid
| eval cve = "CVE-2024-23897"
| eval severity = "critical"
| table _time, aid, ComputerName, LocalAddressIP4, RemoteAddressIP4, LocalPort, ImageFileName, CommandLine, ParentImageFileName, UserName, SHA256HashData, cve, severity
| sort - _time