JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

The impact of CVE-2024-29202 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Celery container, which runs with root privileges and has access to the JumpServer database. This grants the attacker the ability to steal sensitive information from all managed hosts, manipulate the database, and potentially gain complete control over the JumpServer environment. The root privileges within the Celery container significantly amplify the potential damage, enabling attackers to escalate their privileges and compromise the underlying infrastructure. This vulnerability shares similarities with other template injection flaws where attackers can leverage the template engine to execute arbitrary commands.

Organizations utilizing JumpServer as a bastion host, particularly those with legacy configurations or those who have not implemented robust input validation practices, are at significant risk. Shared hosting environments where multiple users share a JumpServer instance are also particularly vulnerable, as a compromise of one user could lead to a compromise of the entire system.

• linux / server:

journalctl -u jumpserver-celery -g 'jinja2' | grep -i error

• generic web:

curl -I <jumpServer_URL>/ansible/ | grep 'Content-Type: text/html'

• python: Examine JumpServer Ansible configuration files for unsanitized user input used in Jinja2 templates.

1. 2024-03-29Disclosure

   disclosure

1. Reserviert2024-03-18
2. Veröffentlicht2024-03-29
3. Geändert2025-03-25
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-29202 is to immediately upgrade JumpServer to version 3.10.7 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Celery container to only authorized sources. Implement strict input validation on all data passed to the Ansible component to prevent template injection. Monitor JumpServer logs for suspicious activity related to Jinja2 template processing. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known payload and verifying that it is no longer exploitable.