CVE-2024-40629

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-18 17:15

Updated : 2024-07-19 13:01

NVD link : CVE-2024-40629

Mitre link : CVE-2024-40629

CVE.ORG link : CVE-2024-40629

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-40629", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2024-07-18T17:15:04.613", "references": [{"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "JumpServer es una herramienta de gesti\u00f3n de acceso privilegiado (PAM) de c\u00f3digo abierto que proporciona a los equipos de TI y DevOps acceso seguro y bajo demanda a terminales SSH, RDP, Kubernetes, bases de datos y RemoteApp a trav\u00e9s de un navegador web. Un atacante puede aprovechar el manual de Ansible para escribir archivos arbitrarios, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo (RCE) en el contenedor Celery. El contenedor Celery se ejecuta como root y tiene acceso a la base de datos, lo que permite a un atacante robar todos los secretos de los hosts, crear una nueva cuenta JumpServer con privilegios de administrador o manipular la base de datos de otras formas. Este problema se solucion\u00f3 en las versiones 3.10.12 y 4.0.0. Se recomienda actualizar las versiones seguras. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2024-07-19T13:01:44.567", "sourceIdentifier": "security-advisories@github.com"}