CVE-2024-40628: Jumpserver Information Disclosure Flaw

CVE-2024-40628 Overview

CVE-2024-40628 is a critical path traversal vulnerability affecting JumpServer, an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database, and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook functionality to read arbitrary files within the Celery container, leading to sensitive information disclosure with severe consequences for the entire JumpServer deployment.

Critical Impact

The Celery container runs as root with database access, allowing attackers to steal all host secrets, create new JumpServer accounts with admin privileges, or manipulate the database in other ways. This vulnerability enables complete compromise of the PAM infrastructure.

Affected Products

• Fit2cloud JumpServer versions prior to 3.10.12
• Fit2cloud JumpServer versions prior to 4.0.0

Discovery Timeline

• July 18, 2024 - CVE-2024-40628 published to NVD
• March 25, 2025 - Last updated in NVD database

Technical Details for CVE-2024-40628

Vulnerability Analysis

This vulnerability falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The flaw exists within JumpServer's Ansible playbook execution mechanism, which fails to properly validate or sanitize file paths before accessing files within the Celery container.

The exploitation chain is particularly dangerous because the Celery container operates with root privileges and maintains direct database connectivity. This elevated access context transforms what might otherwise be a contained information disclosure issue into a full system compromise scenario. An attacker leveraging this vulnerability can not only read sensitive configuration files and credentials but can also leverage the database access to escalate privileges, create administrative accounts, or tamper with audit logs.

Root Cause

The root cause of CVE-2024-40628 lies in insufficient input validation within the Ansible playbook processing logic. The application fails to properly sanitize user-controlled input that influences file path construction, allowing directory traversal sequences (such as ../) to escape intended directory boundaries. This enables unauthorized read access to arbitrary files accessible to the Celery container process running as root.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft malicious requests targeting the Ansible playbook functionality, embedding path traversal sequences to access files outside the intended scope.

The attack flow typically involves:

1. Identifying a JumpServer instance exposed to the network
2. Crafting a malicious Ansible playbook request with path traversal sequences
3. Reading sensitive files such as database credentials, API keys, or configuration files
4. Leveraging the extracted information to create admin accounts or exfiltrate host secrets

For detailed technical analysis of this vulnerability and the exploitation methodology, refer to the SonarSource Blog Analysis.

Detection Methods for CVE-2024-40628

Indicators of Compromise

• Unusual file access patterns within the Celery container logs, particularly attempts to read files outside expected directories
• Unexpected Ansible playbook execution requests containing path traversal sequences such as ../ or encoded variants
• Creation of new administrator accounts without corresponding legitimate provisioning workflows
• Anomalous database queries or modifications originating from the Celery container

Detection Strategies

• Monitor Ansible playbook execution logs for suspicious file path patterns containing directory traversal sequences
• Implement file integrity monitoring on sensitive configuration files within the JumpServer deployment
• Audit database activity for unauthorized account creation or privilege escalation operations
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts in request payloads

Monitoring Recommendations

• Enable verbose logging for Ansible playbook executions and forward logs to a SIEM for correlation analysis
• Configure alerting for new administrator account creation events in JumpServer
• Monitor the Celery container for unexpected process executions or file access patterns
• Implement network monitoring to detect unusual outbound connections that may indicate data exfiltration

How to Mitigate CVE-2024-40628

Immediate Actions Required

• Upgrade JumpServer immediately to version 3.10.12 or 4.0.0 or later
• Audit existing JumpServer administrator accounts for any unauthorized additions
• Review Celery container logs for evidence of exploitation attempts
• Rotate all secrets and credentials stored within JumpServer as a precautionary measure
• Restrict network access to JumpServer instances to authorized IP ranges only

Patch Information

The JumpServer development team has addressed this vulnerability in release versions 3.10.12 and 4.0.0. Organizations running vulnerable versions should upgrade immediately. Detailed patch information and security advisory details are available in the GitHub Security Advisory GHSA-rpf7-g4xh-84v9.

Workarounds

• No official workarounds are available for this vulnerability according to the vendor advisory
• As a temporary measure, restrict network access to JumpServer to trusted networks only
• Implement additional network segmentation around the JumpServer deployment
• Deploy monitoring and alerting for suspicious activity until patching can be completed
• Consider temporarily disabling Ansible playbook functionality if operationally feasible

# Example: Restrict network access to JumpServer using iptables
# Only allow access from trusted management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP