CVE-2023-42819 Path traversal in Jumpserver
Logged-in users can read or modify arbitrary system files via path traversal in JumpServer's playbook API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-42819?
CVE-2023-42819 is a high-severity path traversal vulnerability in jumpserver, published on 26 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-492d-bd92-832bacc3df5f'. An attacker can exploit the directory traversal flaw using the provided URL to access and retrieve the contents of the file. `https://jumpserver-ip/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd` a similar method to modify the file content is also present. This issue has been addressed in version 3.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2023-42819?
It affects 1 product.
Products include Fit2cloud Jumpserver.
How do I fix CVE-2023-42819?
No fix has been published for CVE-2023-42819 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-42819 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42819 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in jumpserver
- CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2023-48193 Security feature bypass in n/a
Sources
Also known as GHSA-ghg2-2whp-6m33.