Medium severity · published Sep 15, 2023
CVE-2023-42442
JumpServer is an open source bastion host and a professional operation and maintenance security audit system
5.3
CVSS
63%
EPSS
No
On KEV
Description
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)63.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
Jumpserver · Fit2cloud
3.0.0 before 3.5.5; 3.6.0 before 3.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42442
Product
https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
Patch
https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
Exploit
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-633x-3f4f-v9rw
More from Jumpserver
9.9
CVE-2024-29202
JumpServer is an open source bastion host and an operation and maintenance security audit system
9.9
CVE-2024-29201
JumpServer is an open source bastion host and an operation and maintenance security audit system
9.9
CVE-2023-43651
JumpServer is an open source bastion host
9.9
CVE-2023-28110
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service
9.8
CVE-2024-40629
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and…