CVE-2023-42442 JumpServer session replays download without authentication
Attackers can download session replays without authentication due to broken permission controls in the JumpServer API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-42442?
CVE-2023-42442 is a high-severity missing authorization vulnerability in jumpserver, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
Weakness: CWE-287
Which versions are affected by CVE-2023-42442?
It affects 1 product.
Products include Fit2cloud Jumpserver.
How do I fix CVE-2023-42442?
No fix has been published for CVE-2023-42442 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-42442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42442 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in jumpserver
- CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2023-48193 Security feature bypass in n/a
Sources
Also known as GHSA-633x-3f4f-v9rw.