CVE-2023-43652 Non-MFA account takeover via using only SSH public key to login in jumpserver
Attackers can authenticate using only a leaked SSH public key and username, bypassing MFA and gaining unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-43652?
CVE-2023-43652 is a high-severity authentication bypass vulnerability in jumpserver, published on 27 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered public knowledge and should not used as an authentication secret alone. JumpServer provides an API for the KoKo component to validate user private key logins. This API does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions. This issue has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-862
Which versions are affected by CVE-2023-43652?
It affects 1 product.
Products include Fit2cloud Jumpserver.
How do I fix CVE-2023-43652?
No fix has been published for CVE-2023-43652 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-43652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43652 exists.
Other vulnerabilities in jumpserver
- CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2023-48193 Security feature bypass in n/a
Sources
Also known as GHSA-fr8h-xh5x-r8g9.