CVE-2024-40629: Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
First published: Thu Jul 18 2024(Updated: )
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fit2cloud Jumpserver | >=3.0.0<3.10.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-40629?
CVE-2024-40629 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-40629?
To fix CVE-2024-40629, it is recommended to upgrade JumpServer to a version above 3.10.12.
What types of systems are affected by CVE-2024-40629?
CVE-2024-40629 affects JumpServer versions from 3.0.0 to 3.10.12 inclusive.
What can an attacker do by exploiting CVE-2024-40629?
An attacker can exploit CVE-2024-40629 to write arbitrary files on the affected system.
Is there a patch available for CVE-2024-40629?
Yes, a patch for CVE-2024-40629 is included in the latest versions of JumpServer above 3.10.12.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/fit2cloud
- canonical/fit2cloud jumpserver
- version/fit2cloud jumpserver/3.0.0