CVE-2023-42819: Jumpserver Path Traversal Vulnerability

CVE-2023-42819 Overview

CVE-2023-42819 is a critical directory traversal vulnerability affecting JumpServer, an open source bastion host solution. Authenticated users can exploit this flaw to access and modify the contents of any file on the system. The vulnerability exists in the Job-Template playbook functionality, where an attacker can create a playbook and then leverage the playbook API endpoint with directory traversal sequences to read or write arbitrary files.

Critical Impact

Authenticated attackers can read sensitive system files like /etc/passwd and modify critical configuration files, potentially leading to complete system compromise, credential theft, and lateral movement across managed infrastructure.

Affected Products

• Fit2cloud JumpServer versions prior to 3.6.5

Discovery Timeline

• 2023-09-27 - CVE-2023-42819 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-42819

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) allows authenticated users to escape the intended directory structure when accessing playbook files through the JumpServer API. The vulnerability is accessible over the network and requires only low-privilege authentication to exploit. A successful attack can result in unauthorized access to confidential data, modification of system files, and potential denial of service through file corruption.

The exploitation flow involves creating a playbook through the Job-Template menu, obtaining its unique identifier (UUID), and then crafting a malicious API request with path traversal sequences (../) to access files outside the intended directory scope.

Root Cause

The root cause is improper input validation in the playbook file access API endpoint. The key parameter accepts user-supplied input without properly sanitizing directory traversal sequences. This allows attackers to navigate outside the designated playbook directory by using relative path references like ../../../../../../../etc/passwd.

Attack Vector

The attack is network-based and requires an authenticated session. An attacker with valid credentials can:

1. Navigate to the Job-Template menu and create a new playbook (e.g., named "test")
2. Retrieve the playbook's UUID from the detail page
3. Craft a malicious GET request to the API endpoint with traversal sequences in the key parameter

The vulnerable API endpoint follows this pattern:
/api/v1/ops/playbook/{playbook-uuid}/file/?key=../../../../../../../{target-file}

This same mechanism can be used to modify file contents by sending appropriate write requests to the endpoint.

Detection Methods for CVE-2023-42819

Indicators of Compromise

• HTTP requests to /api/v1/ops/playbook/ endpoints containing ../ sequences
• Unexpected file access patterns in JumpServer logs involving system files like /etc/passwd, /etc/shadow, or configuration files
• Anomalous playbook creation followed immediately by file retrieval requests
• Web server access logs showing encoded directory traversal patterns (%2e%2e%2f or ..%2f)

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block directory traversal patterns in URL parameters
• Monitor API access logs for unusual key parameter values containing path traversal sequences
• Configure SIEM alerts for any access attempts to sensitive system files through web application interfaces
• Audit playbook creation and file access activities for suspicious patterns

Monitoring Recommendations

• Enable verbose logging for JumpServer API endpoints, particularly the playbook file access functionality
• Monitor for repeated authentication attempts followed by playbook operations
• Track file system access from the JumpServer application process for anomalous behavior
• Implement endpoint detection rules to identify unauthorized file reads or modifications

How to Mitigate CVE-2023-42819

Immediate Actions Required

• Upgrade JumpServer to version 3.6.5 or later immediately
• Review access logs for evidence of exploitation attempts
• Audit user accounts for unauthorized access or privilege escalation
• Verify integrity of critical system files and configuration

Patch Information

JumpServer has addressed this vulnerability in version 3.6.5. The fix is available in commit d0321a74f1713d031560341c8fd0a1859e6510d8. Users should upgrade to the patched version as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-ghg2-2whp-6m33 and the GitHub commit with the fix.

Workarounds

• There are no known workarounds for this vulnerability according to the vendor advisory
• Consider restricting network access to the JumpServer instance to trusted IP ranges as a temporary measure
• Implement strict web application firewall rules to block directory traversal attempts until patching is possible
• Temporarily disable or restrict access to the Job-Template functionality if operationally feasible

# Upgrade JumpServer to patched version
# Follow official JumpServer upgrade documentation for your deployment method
# Verify current version
jumpserver --version

# For Docker deployments, pull the latest patched image
docker pull jumpserver/jms_all:v3.6.5