Vulnerability · Published Mar 29, 2024 · Assigned by GitHub_M

CVE-2024-29201JumpServer's insecure Ansible playbook validation leads to RCE in Celery

Critical 10.0

In plain English

A critical-severity code injection in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)6.0%top 6.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Affected products (as reported)

Vendor	Product	Versions
jumpserver	jumpserver	>= 3.0.0, <= 3.10.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj x_refsource_CONFIRM
https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 x_refsource_MISC