Ansible Playbookにおける任意のファイル読み出しの脆弱性 (Arbitrary File Read) in Jumpserver

The impact of CVE-2024-40628 is substantial. Successful exploitation allows an attacker to read any file accessible by the Celery container, which runs as root. This includes sensitive configuration files, database credentials, and potentially even the JumpServer database itself. An attacker could steal secrets for managed hosts, create new JumpServer accounts with administrative privileges, or directly manipulate the database to gain persistent control over the system. The blast radius extends to all hosts managed by JumpServer, as compromised credentials could facilitate lateral movement. This vulnerability shares similarities with other privilege escalation exploits where container misconfigurations expose sensitive data.

Organizations heavily reliant on JumpServer for privileged access management are at significant risk. Specifically, deployments with misconfigured Celery containers or those lacking robust file permission controls are particularly vulnerable. Shared hosting environments utilizing JumpServer also face increased risk due to potential cross-tenant access.

• linux / server:

journalctl -u celery -f | grep -i "arbitrary file access"

• linux / server:

lsof -p $(pidof celery) | grep /path/to/sensitive/file

• generic web:

curl -I http://jump-server/ansible/playbook/ | grep -i "sensitive_data"

1. 2024-07-18Disclosure

   disclosure

1. 予約済み2024-07-08
2. 公開日2024-07-18
3. 更新日2025-03-25
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-40628 is to immediately upgrade JumpServer to version 3.10.12 or later. If upgrading is not immediately feasible, consider isolating the Celery container to limit its access to sensitive files. Implement strict file permissions within the container to restrict read access. Monitor the Celery container's logs for suspicious activity, particularly attempts to access unusual files. While a WAF cannot directly prevent this vulnerability, it can help detect and block malicious requests targeting the Ansible playbook. No specific Sigma or YARA rules are currently available, but monitoring for unusual file access patterns within the Celery container is recommended. After upgrading, confirm the fix by attempting to access a known sensitive file from outside the container – access should be denied.