CVE-2024-40629: Fit2cloud JumpServer RCE Vulnerability

CVE-2024-40629 Overview

CVE-2024-40629 is a critical path traversal vulnerability affecting JumpServer, an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database, and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook functionality to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways.

Critical Impact

This vulnerability enables unauthenticated remote attackers to achieve complete system compromise through arbitrary file write and subsequent code execution with root privileges, providing full access to stored credentials and administrative controls.

Affected Products

• Fit2cloud JumpServer versions prior to 3.10.12
• Fit2cloud JumpServer versions prior to 4.0.0

Discovery Timeline

• 2024-07-18 - CVE-2024-40629 published to NVD
• 2025-03-25 - Last updated in NVD database

Technical Details for CVE-2024-40629

Vulnerability Analysis

This vulnerability stems from improper path validation in the Ansible playbook execution component of JumpServer. The flaw allows attackers to traverse directory boundaries and write arbitrary files to locations outside the intended directories. Since the Celery container responsible for task execution runs with root privileges and maintains direct database connectivity, successful exploitation grants attackers complete control over the JumpServer environment.

The attack surface is particularly severe given JumpServer's role as a privileged access management solution. Organizations deploy JumpServer to centralize and secure access to critical infrastructure components including SSH servers, RDP endpoints, Kubernetes clusters, and databases. Compromising this centralized access point provides attackers with a gateway to numerous downstream systems and their associated credentials.

Root Cause

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The Ansible playbook functionality fails to properly sanitize or validate file paths provided by users, allowing directory traversal sequences to escape the intended directory scope. This lack of input validation enables attackers to write files to arbitrary locations on the file system.

Attack Vector

The attack is network-based and can be executed without authentication or user interaction. An attacker can craft malicious Ansible playbook configurations that include path traversal sequences (such as ../) to escape the designated playbook directory. By writing malicious files to strategic locations within the Celery container's file system, the attacker can achieve code execution.

Once code execution is achieved within the Celery container, the attacker inherits root privileges and database access. This enables several devastating attack scenarios:

• Credential Theft: Extraction of all stored secrets and credentials for managed hosts
• Privilege Escalation: Creation of new administrative accounts within JumpServer
• Database Manipulation: Direct modification of database records to alter access controls, audit logs, or system configurations
• Lateral Movement: Using stolen credentials to access managed infrastructure endpoints

The vulnerability requires no special prerequisites beyond network access to the JumpServer instance, making it highly exploitable in exposed deployments.

Detection Methods for CVE-2024-40629

Indicators of Compromise

• Unexpected file creation or modification in system directories within the Celery container
• Suspicious Ansible playbook executions containing path traversal patterns such as ../ sequences
• Unauthorized database queries or modifications, particularly involving user accounts or credential stores
• New administrative accounts created without corresponding legitimate requests

Detection Strategies

• Monitor Ansible playbook submissions for path traversal sequences and directory escape attempts
• Implement file integrity monitoring on critical system directories within JumpServer containers
• Review JumpServer audit logs for anomalous playbook execution patterns or unauthorized administrative actions
• Deploy network intrusion detection rules to identify exploitation attempts targeting the playbook endpoint

Monitoring Recommendations

• Enable comprehensive logging for all Ansible playbook operations and file system activities
• Configure alerts for any file write operations outside designated playbook directories
• Monitor database audit logs for unexpected credential access or user creation events
• Implement real-time alerting for privileged operations performed through the Celery container

How to Mitigate CVE-2024-40629

Immediate Actions Required

• Upgrade JumpServer to version 3.10.12 or 4.0.0 immediately
• Audit existing deployments for signs of compromise, including unauthorized accounts or credential access
• Review network exposure and restrict access to JumpServer management interfaces
• Rotate all credentials stored within JumpServer as a precautionary measure

Patch Information

The JumpServer development team has addressed this vulnerability in release versions 3.10.12 and 4.0.0. Organizations should upgrade to one of these patched versions as soon as possible. The security advisory is available through the GitHub Security Advisory. Additional technical analysis is available from SonarSource's blog post covering the vulnerability details.

Workarounds

• There are no known workarounds for this vulnerability according to the vendor advisory
• Network segmentation to limit exposure of JumpServer to trusted networks only provides partial risk reduction
• Implementing strict network access controls and firewall rules can reduce attack surface while awaiting patching
• Monitor all JumpServer activity closely until patches can be applied