Vulnerability · Published Mar 29, 2024 · Assigned by GitHub_M

CVE-2024-29202JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

Critical 10.0

In plain English

A critical-severity code injection in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)5.9%top 6.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Affected products (as reported)

Vendor	Product	Versions
jumpserver	jumpserver	>= 3.0.0, <= 3.10.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch x_refsource_CONFIRM
https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 x_refsource_MISC