PT-2023-7011 · Unknown · Jumpserver
Oskar-Zeinomahmalat-Sonarsource
·
Published
2023-09-27
·
Updated
2025-03-25
·
CVE-2023-43652
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
JumpServer versions prior to 2.28.20
JumpServer versions prior to 3.7.1
Description
The issue concerns the authentication procedure in JumpServer, an open source bastion host. An unauthenticated user can authenticate to the core API using a username and an SSH public key without needing a password or the corresponding SSH private key. This is possible because the API for the KoKo component to validate user private key logins does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions.
Recommendations
For versions prior to 2.28.20, upgrade to version 2.28.20 or later.
For versions prior to 3.7.1, upgrade to version 3.7.1 or later.
As a temporary workaround, consider restricting access to the KoKo component API until a patch is available.
Avoid using the
username and SSH public key for authentication until the issue is resolved.Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jumpserver