PT-2024-4192 · Unknown · Jumpserver

Oskar-Zeinomahmalat-Sonarsource · Published 2024-03-29 · Updated 2025-01-09 · CVE-2024-29201

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 3.10.7

Description The issue is related to insufficient input validation in JumpServer's Ansible, allowing remote attackers to bypass the input validation mechanism and execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database.

Recommendations For versions prior to 3.10.7, update to version 3.10.7 to resolve the issue. As a temporary workaround, consider restricting access to the Ansible module in JumpServer to minimize the risk of exploitation.

Exploit

Fix

Improper Neutralization

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-707

CWE-74

CWE-94

Related Identifiers

BDU:2024-04677

CVE-2024-29201

GHSA-PJPP-CM9X-6RWJ

Affected Products

Jumpserver

References · 15

• 🔥 https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29201.json · Exploit
• https://bdu.fstec.ru/vul/2024-04677 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29201 · Security Note
• https://twitter.com/VulmonFeeds/status/1773753961041838135 · Twitter Post
• https://t.me/cybersecuritytechnologies/10328 · Telegram Post
• https://twitter.com/iSecurity/status/1775409937285513661 · Twitter Post
• https://twitter.com/CVEnew/status/1773730746613510601 · Twitter Post
• https://vuldb.com/?id.258693 · Note
• https://twitter.com/Dinosn/status/1775093622460838052 · Twitter Post
• https://t.me/pentestingnews/45381 · Telegram Post
• https://twitter.com/fletch_ai/status/1775402986422112558 · Twitter Post
• https://sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 · Note
• https://twitter.com/moton/status/1775161486668935197 · Twitter Post