Platform
python
Component
jumpserver
Fixed in
3.0.1
CVE-2024-29202 describes a critical Remote Code Execution (RCE) vulnerability discovered in JumpServer, an open-source bastion host. This flaw allows attackers to inject malicious Jinja2 templates within the Ansible component, leading to arbitrary code execution within the Celery container. The vulnerability impacts JumpServer versions 3.0.0 through 3.10.6, and a fix is available in version 3.10.7.
The impact of CVE-2024-29202 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Celery container, which runs with root privileges and has access to the JumpServer database. This grants the attacker the ability to steal sensitive information from all managed hosts, manipulate the database, and potentially gain complete control over the JumpServer environment. The root privileges within the Celery container significantly amplify the potential damage, enabling attackers to escalate their privileges and compromise the underlying infrastructure. This vulnerability shares similarities with other template injection flaws where attackers can leverage the template engine to execute arbitrary commands.
CVE-2024-29202 was publicly disclosed on March 29, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's critical severity and ease of exploitation suggest a high probability of exploitation. It is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the vulnerability's nature and severity.
Exploit Status
EPSS
81.15% (99% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-29202 is to immediately upgrade JumpServer to version 3.10.7 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Celery container to only authorized sources. Implement strict input validation on all data passed to the Ansible component to prevent template injection. Monitor JumpServer logs for suspicious activity related to Jinja2 template processing. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known payload and verifying that it is no longer exploitable.
Update JumpServer to version 3.10.7 or higher. This version fixes the Jinja2 template injection vulnerability in Ansible that allows remote code execution. The update will mitigate the risk of attackers executing arbitrary code in the Celery container and accessing sensitive information.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-29202 is a critical Remote Code Execution vulnerability in JumpServer versions 3.0.0–3.10.6, allowing attackers to execute arbitrary code via a Jinja2 template injection.
If you are running JumpServer versions 3.0.0 through 3.10.6, you are potentially affected by this vulnerability. Upgrade to 3.10.7 or later immediately.
The recommended fix is to upgrade JumpServer to version 3.10.7 or later. If immediate upgrade is not possible, implement temporary workarounds like restricting network access and input validation.
While no confirmed active exploitation campaigns have been reported, the vulnerability's severity and ease of exploitation suggest a high probability of exploitation.
Refer to the official JumpServer security advisory for detailed information and updates: [https://github.com/JumpCloud/JumpServer/security/advisories/GHSA-9999](https://github.com/JumpCloud/JumpServer/security/advisories/GHSA-9999)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.