CVE-2024-40628: Arbitrary File Access in JumpServer

The impact of CVE-2024-40628 is substantial. Successful exploitation allows an attacker to read any file accessible by the Celery container, which runs as root. This includes sensitive configuration files, database credentials, and potentially even the JumpServer database itself. An attacker could steal secrets for managed hosts, create new JumpServer accounts with administrative privileges, or directly manipulate the database to gain persistent control over the system. The blast radius extends to all hosts managed by JumpServer, as compromised credentials could facilitate lateral movement. This vulnerability shares similarities with other privilege escalation exploits where container misconfigurations expose sensitive data.

1. Reserved2024-07-08
2. Published2024-07-18
3. Modified2025-03-25
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-40628 is to immediately upgrade JumpServer to version 3.10.12 or later. If upgrading is not immediately feasible, consider isolating the Celery container to limit its access to sensitive files. Implement strict file permissions within the container to restrict read access. Monitor the Celery container's logs for suspicious activity, particularly attempts to access unusual files. While a WAF cannot directly prevent this vulnerability, it can help detect and block malicious requests targeting the Ansible playbook. No specific Sigma or YARA rules are currently available, but monitoring for unusual file access patterns within the Celery container is recommended. After upgrading, confirm the fix by attempting to access a known sensitive file from outside the container – access should be denied.