平台
python
组件
jumpserver
修复版本
3.0.1
CVE-2024-29202 describes a critical Remote Code Execution (RCE) vulnerability discovered in JumpServer, an open-source bastion host. This flaw allows attackers to inject malicious Jinja2 templates within the Ansible component, leading to arbitrary code execution within the Celery container. The vulnerability impacts JumpServer versions 3.0.0 through 3.10.6, and a fix is available in version 3.10.7.
The impact of CVE-2024-29202 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Celery container, which runs with root privileges and has access to the JumpServer database. This grants the attacker the ability to steal sensitive information from all managed hosts, manipulate the database, and potentially gain complete control over the JumpServer environment. The root privileges within the Celery container significantly amplify the potential damage, enabling attackers to escalate their privileges and compromise the underlying infrastructure. This vulnerability shares similarities with other template injection flaws where attackers can leverage the template engine to execute arbitrary commands.
CVE-2024-29202 was publicly disclosed on March 29, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's critical severity and ease of exploitation suggest a high probability of exploitation. It is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the vulnerability's nature and severity.
Organizations utilizing JumpServer as a bastion host, particularly those with legacy configurations or those who have not implemented robust input validation practices, are at significant risk. Shared hosting environments where multiple users share a JumpServer instance are also particularly vulnerable, as a compromise of one user could lead to a compromise of the entire system.
• linux / server:
journalctl -u jumpserver-celery -g 'jinja2' | grep -i error• generic web:
curl -I <jumpServer_URL>/ansible/ | grep 'Content-Type: text/html'• python: Examine JumpServer Ansible configuration files for unsanitized user input used in Jinja2 templates.
disclosure
漏洞利用状态
EPSS
81.15% (99% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2024-29202 is to immediately upgrade JumpServer to version 3.10.7 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Celery container to only authorized sources. Implement strict input validation on all data passed to the Ansible component to prevent template injection. Monitor JumpServer logs for suspicious activity related to Jinja2 template processing. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known payload and verifying that it is no longer exploitable.
将 JumpServer 更新到 3.10.7 或更高版本。此版本修复了 Ansible 中 Jinja2 模板注入漏洞，该漏洞允许远程代码执行。升级将降低攻击者在 Celery 容器中执行任意代码并访问敏感信息的风险。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2024-29202 is a critical Remote Code Execution vulnerability in JumpServer versions 3.0.0–3.10.6, allowing attackers to execute arbitrary code via a Jinja2 template injection.
If you are running JumpServer versions 3.0.0 through 3.10.6, you are potentially affected by this vulnerability. Upgrade to 3.10.7 or later immediately.
The recommended fix is to upgrade JumpServer to version 3.10.7 or later. If immediate upgrade is not possible, implement temporary workarounds like restricting network access and input validation.
While no confirmed active exploitation campaigns have been reported, the vulnerability's severity and ease of exploitation suggest a high probability of exploitation.
Refer to the official JumpServer security advisory for detailed information and updates: [https://github.com/JumpCloud/JumpServer/security/advisories/GHSA-9999](https://github.com/JumpCloud/JumpServer/security/advisories/GHSA-9999)
上传你的 requirements.txt 文件，立即知道是否受影响。