La validation insecure des playbooks Ansible dans JumpServer conduit à une exécution de code à distance (RCE) dans Celery

The impact of CVE-2024-29201 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Celery container, which runs with root privileges and has direct access to the JumpServer database. This grants the attacker the ability to steal sensitive information from all managed hosts, modify user credentials, and potentially gain complete control over the JumpServer infrastructure. The ability to manipulate the database could lead to data breaches, unauthorized access, and disruption of critical operations. The root privileges within the container significantly amplify the potential damage, allowing for lateral movement and broader compromise of the environment.

Organizations heavily reliant on JumpServer as a central bastion host and those with legacy configurations that haven't been regularly patched are particularly at risk. Shared hosting environments where multiple users share a JumpServer instance also face increased exposure, as a compromise of one user could potentially lead to broader system compromise.

• linux / server:

journalctl -u jumpserver-celery -f | grep -i "ansible" # Monitor Celery logs for Ansible activity

• linux / server:

lsof -i :8000 # Check for processes listening on the Ansible port

• generic web:

curl -I http://<jumpserver_ip>:8000/ansible/ # Check for Ansible endpoint exposure

1. 2024-03-29Disclosure

   disclosure

2. 2024-03-29Patch

   patch

1. Réservé2024-03-18
2. Publiée2024-03-29
3. Modifiée2025-03-25
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-29201 is to immediately upgrade JumpServer to version 3.10.7 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the Celery container or disabling the Ansible functionality. Monitor JumpServer logs for suspicious activity related to Ansible execution. Implement a Web Application Firewall (WAF) with rules to detect and block malicious requests targeting the Ansible endpoint. After upgrading, verify the fix by attempting to trigger the vulnerable Ansible endpoint with a crafted payload and confirming that the execution is blocked.