CVE-2023-42442

HIGHNuclei

JumpServer session replays download without authentication

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-42442 has a selected CVSS score of 8.2 (high); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 25, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

jumpserver

Browse jumpserver / jumpserver
CVE List>= 3.0.0, < 3.5.5affected
>= 3.6.0, < 3.6.4affected

Proofs of concept

2

Repository PoCs

GitHubHolyGu/CVE-2023-42442Repository PoCby HolyGu40Not analyzed2 files

4.3 KiB

GitHub
PoC details
GitHubtarihub/blackjumpRepository PoCby tarihub276Not analyzed9 files

259.7 KiB · linked to 3 vulnerabilities

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMJumpServer > 3.6.4 - Information DisclosureCVSS 5.3

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

Impact

The vulnerability allows an attacker to gain sensitive information from the JumpServer application.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-287
Authorsxianke
Template tagscve2023cvejumpserverexposurefit2cloudvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*
FOFA: title="JumpServer"
FOFA: title="jumpserver"
https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91 https://nvd.nist.gov/vuln/detail/CVE-2023-42442 https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a https://github.com/Marco-zcl/POC https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

3