CVE-2023-42818 SSH public key login without private key challenge if mfa is enabled in jumpserver
Attackers can bypass SSH private key verification during MFA-enabled public key authentication, allowing unauthorized access to the bastion host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-42818?
CVE-2023-42818 is a medium-severity authentication bypass vulnerability in jumpserver, published on 27 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.
Which versions are affected by CVE-2023-42818?
2 open source packages ship an affected version, including github.com/jumpserver/jumpserver and github.com/jumpserver/koko. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jumpserver/jumpserver Go | All versions | 3.5.6+incompatible, 3.6.5+incompatible |
github.com/jumpserver/koko Go | All versions | None |
Products include Fit2cloud Jumpserver.
How do I fix CVE-2023-42818?
Upgrade github.com/jumpserver/jumpserver to a fixed version for your release line: 3.5.6+incompatible or 3.6.5+incompatible.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-42818 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42818 exists.
Other vulnerabilities in jumpserver
- CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2023-48193 Security feature bypass in n/a
Sources
Also known as GHSA-jv3c-27cv-w8jv, GO-2025-3570.