by Kastro
Paper/Archive/CVE-2023-42818

CVE-2023-42818

jumpserver jumpserver — SSH public key login without private key challenge if mfa is enabled in jumpserver

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.2.522 × 2010.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.

Affected

ProductAffectedFixed inSource
jumpserver>= 3.6.0, < 3.6.5–CNA
jumpserver< 3.5.6–CNA
jumpserver3.6.0 – < 3.6.53.6.5CISA-ADP
jumpserver< 3.5.63.5.6CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jvrefsonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2