CVE-2023-28110 JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

What is CVE-2023-28110?

CVE-2023-28110 is a medium-severity command injection vulnerability in jumpserver, published on 16 Mar 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.

Weakness: CWE-77

Which versions are affected by CVE-2023-28110?

It affects 2 products.

Products include Fit2cloud Jumpserver, Fit2cloud Koko.

How do I fix CVE-2023-28110?

No fix has been published for CVE-2023-28110 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-28110 being exploited?

There is no known exploitation of CVE-2023-28110 in the wild and no public exploit code.

Other vulnerabilities in jumpserver

• CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver Critical 10.0
• CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver Critical 10.0
• CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery Critical 10.0
• CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery Critical 10.0
• CVE-2023-48193 Security feature bypass in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6x5p-jm59-jh29.