// For flags

CVE-2024-29201

JumpServer's insecure Ansible playbook validation leads to RCE in Celery

Severity Score

9.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

JumpServer es un host bastión de código abierto y un sistema de auditoría de seguridad de operación y mantenimiento. Los atacantes pueden eludir el mecanismo de validación de entrada en Ansible de JumpServer para ejecutar código arbitrario dentro del contenedor Celery. Dado que el contenedor Celery se ejecuta con privilegios de root y tiene acceso a la base de datos, los atacantes podrían robar información confidencial de todos los hosts o manipular la base de datos. Esta vulnerabilidad se solucionó en v3.10.7.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-03-18 CVE Reserved
  • 2024-03-29 CVE Published
  • 2024-03-30 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jumpserver
Search vendor "Jumpserver"
 Jumpserver
Search vendor "Jumpserver" for product "Jumpserver"
 >= 3.0.0 <= 3.10.6
Search vendor "Jumpserver" for product "Jumpserver" and version " >= 3.0.0 <= 3.10.6"
en
Affected