CVE-2024-24763

Executive Summary

CVE-2024-24763 is an open redirect vulnerability in JumpServer, an open-source bastion host and operation and maintenance security audit system. Versions prior to 3.10.0 are affected. An attacker can exploit this flaw by crafting a malicious link that, when clicked by an authenticated user, redirects them to an attacker-controlled external domain. This can facilitate phishing attacks or serve as a vector for cross-site scripting (XSS) by redirecting users to malicious sites. The vulnerability is classified as medium severity with a CVSS score of 4.3. A public proof-of-concept (PoC) exists via a Nuclei template, and exploitation requires user interaction. The official patch is included in version 3.10.0.

Supply Chain & Package Security

JumpServer is a Python-based application distributed via GitHub and Docker. The vulnerability exists in the authentication flow, specifically in the next parameter handling during login. No malicious packages or compromised dependencies have been identified in relation to this CVE. However, organizations should verify the integrity of their JumpServer installation by checking checksums or using signed releases from the official repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the redirect.
• User Interaction (UI): Required (R) – Victim must click the crafted link.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker-controlled target are separate.
• Confidentiality Impact (C): None (N) – No data exposure.
• Integrity Impact (I): None (N) – No data modification.
• Availability Impact (A): Low (L) – The redirect itself does not affect availability, but phishing/XSS could lead to account compromise.

Threat Level: Medium. The vulnerability requires user interaction and does not directly expose data, but it can be chained with phishing or XSS to achieve higher impact.

Deep Dive & Mechanics

The vulnerability resides in the login redirect functionality of JumpServer. When a user accesses a URL like /core/auth/login/?next=//attacker.com, the application processes the next parameter to redirect the user after successful authentication. Due to insufficient validation, the application does not properly sanitize the next parameter, allowing an attacker to specify an external domain (e.g., //oast.me). The double slash (//) bypasses relative path checks, causing the browser to interpret the URL as a protocol-relative redirect to an external host.

Attack Flow:

1. An attacker crafts a malicious link: https://victim-jumpserver.example.com/core/auth/login/?next=//evil.com.
2. The attacker sends this link to a victim (e.g., via email or social engineering).
3. The victim, who may be authenticated or not, clicks the link.
4. The JumpServer login page loads, and if the victim logs in (or is already authenticated), the server redirects the browser to //evil.com.
5. The victim lands on the attacker's site, which may mimic the JumpServer login page to steal credentials or serve malware.

Root Cause: The next parameter is not validated against a whitelist of allowed domains or paths. The application fails to reject URLs that point to external hosts.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.10.0): The login view likely processes the next parameter without proper validation. A simplified example:

def login(request):
    next_url = request.GET.get('next', '/')
    # No validation of next_url
    return redirect(next_url)

Patched Code (3.10.0+): The patch introduces validation to ensure the next parameter is a relative path or belongs to an allowed domain. Example:

from urllib.parse import urlparse

def is_safe_url(url):
    parsed = urlparse(url)
    return not parsed.netloc or parsed.netloc == request.get_host()

def login(request):
    next_url = request.GET.get('next', '/')
    if not is_safe_url(next_url):
        next_url = '/'
    return redirect(next_url)

The patch ensures that only relative paths or URLs pointing to the same host are accepted.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable JumpServer instance (version < 3.10.0).
• A listener or server to capture redirected requests (e.g., oast.me or a custom domain).

Exploitation Steps:

1. Identify the JumpServer login endpoint (e.g., https://target-jumpserver/core/auth/login/).
2. Craft a malicious URL with the next parameter pointing to an external domain:

   https://target-jumpserver/core/auth/login/?next=//attacker-controlled.com
   

3. Send the link to a victim via phishing email or social media.
4. When the victim clicks and logs in (or is already authenticated), they will be redirected to attacker-controlled.com.

Nuclei Template (Provided): The following Nuclei template can be used to automate detection of the vulnerability:

id: CVE-2024-24763

info:
  name: JumpServer < 3.10.0 - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.
  impact: |
    Unauthenticated attackers can redirect users to malicious URLs via the next parameter, facilitating phishing attacks or cross-site scripting.
  remediation: |
    Update JumpServer to version 3.10.0 or later.
  reference:
    - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24763
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
    cvss-score: 4.3
    cve-id: CVE-2024-24763
    cwe-id: CWE-601
    epss-score: 0.30679
    epss-percentile: 0.96738
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fit2cloud
    product: jumpserver
    fofa-query:
      - title="JumpServer"
      - title="jumpserver"
  tags: cve2024,cve,jumpserver,redirect,fit2cloud,authenticated,vuln

http:
  - raw:
      - |
        POST /{{paths}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

    payloads:
      paths:
        - "core/auth/login/?next=//oast.me"
        - "auth/login/?next=//oast.me"
        - "login/?next=//oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_]*\.)?oast\.me(?:\s*?)$'

Usage:

1. Save the template as CVE-2024-24763.yaml.
2. Run Nuclei: nuclei -t CVE-2024-24763.yaml -u https://target-jumpserver -v
3. The template will attempt to log in (if credentials are provided) and check for open redirect in the Location header.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing next=// or next=http:// or next=https:// in the login endpoint.
• Look for unusual Location headers in responses that point to external domains.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Honeypot:

• Deploy a fake JumpServer login page and monitor for requests with suspicious next parameters.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /core/auth/login/?next=//*
  • /auth/login/?next=//*
  • /login/?next=//*
• Network Indicators:
  • Outbound connections to unknown domains immediately after a login request.
  • HTTP responses with Location header pointing to external domains (e.g., Location: //evil.com).
• Log Entries:
  • Web server logs showing GET /core/auth/login/?next=// with a 302 response.
  • Authentication logs showing successful login followed by a redirect to an external URL.

Detection Engineering

YARA Rule

rule CVE_2024_24763_JumpServer_Open_Redirect {
    meta:
        description = "Detects JumpServer open redirect exploitation attempts"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-24763"
        hash = "4a0a004730450221008a0c6de543cc0ba4badb04c7a9e6cbdef443fa8e22ee6494bdb152f7508ab32d022013a8d919c598265a0dd922f849e1347a6b36fe36b1f9e05331909a08908d38db"
    strings:
        $s1 = "next=//" ascii wide nocase
        $s2 = "Location: //" ascii wide nocase
        $s3 = "/core/auth/login/" ascii wide nocase
        $s4 = "/auth/login/" ascii wide nocase
        $s5 = "/login/" ascii wide nocase
    condition:
        any of ($s3, $s4, $s5) and ($s1 or $s2)
}

Sigma Rule

title: JumpServer Open Redirect Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-24763 in JumpServer
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24763
    - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-p2mq-cm25-g4m5
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'next=//'
            - 'next=http://'
            - 'next=https://'
        cs-uri-stem|contains:
            - '/core/auth/login/'
            - '/auth/login/'
            - '/login/'
    condition: selection
falsepositives:
    - Legitimate redirects to internal resources (rare)
level: medium
tags:
    - attack.t1190
    - cve.2024.24763

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24763 JumpServer Open Redirect Attempt"; flow:to_server; content:"GET"; http_method; content:"/core/auth/login/"; http_uri; content:"next=//"; http_uri; fast_pattern; sid:1000001; rev:1; reference:cve,2024-24763;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade JumpServer to version 3.10.0 or later. This is the only official fix.
2. If upgrade is not immediately possible, implement a web application firewall (WAF) rule to block requests containing next=// or next=http in the login endpoint.
3. Restrict outbound network access from the JumpServer instance to only necessary domains.

Long-Term Measures:

• Conduct a code review of all redirect functionality to ensure proper validation.
• Implement a whitelist of allowed redirect destinations.
• Educate users about phishing attacks that exploit open redirects.

Workarounds:

• No official workarounds are available. The only mitigation is to upgrade.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 8A75E086400F46124925C3D2] */}