CVE-2023-42819: Path traversal in Jumpserver
JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-492d-bd92-832bacc3df5f'. An attacker can exploit the directory traversal flaw using the provided URL to access and retrieve the contents of the file. https://jumpserver-ip/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd a similar method to modify the file content is also present. This issue has been addressed in version 3.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-42819?
CVE-2023-42819 is a vulnerability in JumpServer, an open source bastion host, that allows logged-in users to access and modify any file on the system.
How does CVE-2023-42819 affect Fit2cloud Jumpserver?
CVE-2023-42819 affects Fit2cloud Jumpserver versions 3.0.0 through 3.6.5.
How severe is CVE-2023-42819?
CVE-2023-42819 has a severity score of 8.9, which is considered high.
How can an attacker exploit CVE-2023-42819?
An attacker can exploit CVE-2023-42819 by creating a playbook named 'test' using the 'Job-Template' menu, and then manipulating the contents of any file on the system.
Is there a fix available for CVE-2023-42819?
Yes, a fix for CVE-2023-42819 is available. Users of Fit2cloud Jumpserver should update to a version beyond 3.6.5.