PT-2023-7220 · Mongodb+1 · Mongodb+1

Oskar-Zeinomahmalat-Sonarsource · Published 2023-09-27 · Updated 2025-03-25 · CVE-2023-43651

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1

Description An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.

Recommendations For JumpServer versions prior to 2.28.20, upgrade to version 2.28.20 or later. For JumpServer versions prior to 3.7.1, upgrade to version 3.7.1 or later. As a temporary workaround, consider restricting access to the WEB CLI interface provided by the koko component until a patch is applied. Avoid using the execSync function in the authorized mongoDB database to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-08248

CVE-2023-43651

GHSA-4R5X-X283-WM96

Affected Products

Jumpserver

Mongodb

References · 14

• 🔥 https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43651.json · Exploit
• https://osv.dev/vulnerability/GHSA-4r5x-x283-wm96 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43651 · Security Note
• https://bdu.fstec.ru/vul/2023-08248 · Security Note
• https://github.com/jumpserver/koko/commit/857f8b9e41f0930dc6190a35d8601fffa5e884e7 · Note
• https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2 · Note
• https://github.com/jumpserver/koko · Note
• https://sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 · Note
• https://twitter.com/VulmonFeeds/status/1707164896272495033 · Twitter Post
• https://t.me/cvenotify/116232 · Telegram Post
• https://t.me/cibsecurity/71158 · Telegram Post
• https://twitter.com/CVEnew/status/1707144352789872785 · Twitter Post