CVE-2024-29201 | JumpServer is an open source bastion host and an operation a… | CVSS 10.0 CRITICAL

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Metadata

CVE ID: CVE-2024-29201
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2024-03-18 17:07 UTC
Published: 2024-03-29 14:57 UTC
Last updated: 2025-03-25 19:38 UTC
Primary CWE: CWE-94
CWE-94: Improper Control of Generation of Code ('Code Inject…
Vendor / Product: jumpserver / jumpserver
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
jumpserver	jumpserver	—	>= 3.0.0, <= 3.10.6

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj
https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2