by Kastro
Paper/Archive/CVE-2024-29201

CVE-2024-29201

jumpserver jumpserver — JumpServer's insecure Ansible playbook validation leads to RCE in Celery

EPSS 6%public exploitCVSS 10.0
critical.is priorityof 100
59
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 93.3.933 × 2018.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Affected

ProductAffectedFixed inSource
jumpserver>= 3.0.0, <= 3.10.6–CNA
jumpserver3.0.0 – 3.10.6–CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwjrefsonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2