CVE-2024-29024

Executive Summary

CVE-2024-29024 is an Insecure Direct Object Reference (IDOR) vulnerability in Jumpserver, an open-source bastion host and operation and maintenance security audit system. An authenticated user can exploit this flaw in the file manager's bulk transfer functionality by manipulating job IDs to upload malicious files. This could lead to unauthorized file uploads, potentially compromising system integrity and security. The vulnerability is fixed in Jumpserver v3.10.6. The CVSS score is 4.6 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood currently. No public exploit code or Nuclei templates are available.

Supply Chain & Package Security

Jumpserver is a Python-based application. The vulnerability does not directly affect the software supply chain (e.g., PyPI packages) but impacts the integrity of the Jumpserver instance itself. Organizations using Jumpserver should prioritize patching to prevent unauthorized file uploads.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication, but once authenticated, exploitation is straightforward. The impact is limited to file uploads, which could lead to further compromise if uploaded files are executed.

Deep Dive & Mechanics

The vulnerability resides in the file manager's bulk transfer functionality. Jumpserver allows users to transfer files between systems via a web-based file manager. The bulk transfer feature uses job IDs to track and process multiple file transfers. An authenticated attacker can manipulate these job IDs to reference jobs they are not authorized to access, leading to an Insecure Direct Object Reference (IDOR) condition.

By crafting a request with a modified job ID, the attacker can upload files to arbitrary locations or to other users' sessions. This bypasses access controls that should restrict file operations to authorized jobs only. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

The attack flow:

1. Authenticate to Jumpserver.
2. Intercept the bulk file transfer request.
3. Modify the job ID parameter to reference a different job.
4. Upload malicious files (e.g., PHP, shell scripts) to unintended directories.
5. If the uploaded file is executed (e.g., via web server), the attacker gains further access.

Vulnerable vs. Patched Code

The fix in v3.10.6 likely involves validating that the job ID belongs to the authenticated user or that the user has proper permissions for the referenced job. Below is a conceptual comparison.

Vulnerable Code (Conceptual):

def upload_file(job_id, file_data):
    job = Job.objects.get(id=job_id)
    # No check if user owns the job
    save_file(job.destination, file_data)

Patched Code (Conceptual):

def upload_file(job_id, file_data, user):
    job = Job.objects.get(id=job_id)
    if job.user != user:
        raise PermissionDenied
    save_file(job.destination, file_data)

The patched version ensures that the user initiating the upload is the owner of the job, preventing IDOR.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated session on Jumpserver (any user role).
• Access to the file manager bulk transfer feature.

Exploitation Steps:

1. Log in to Jumpserver.
2. Navigate to the file manager and initiate a bulk file transfer.
3. Use a proxy (e.g., Burp Suite) to intercept the request.
4. Identify the job_id parameter in the request body.
5. Modify the job_id to a different value (e.g., increment or decrement).
6. Upload a malicious file (e.g., test.php containing <?php system($_GET['cmd']); ?>).
7. If the file is uploaded to a web-accessible directory, access it to execute commands.

Example Request (Intercepted):

POST /api/v1/files/bulk-upload/ HTTP/1.1
Host: jumpserver.example.com
Cookie: sessionid=abc123

job_id=42&file=test.php&content=...

Modified Request:

POST /api/v1/files/bulk-upload/ HTTP/1.1
Host: jumpserver.example.com
Cookie: sessionid=abc123

job_id=43&file=test.php&content=...

Blue Team

Detection:

• Monitor for unusual job ID patterns in file upload requests.
• Alert on multiple failed file upload attempts with different job IDs.
• Check for files uploaded to unexpected directories (e.g., web root).

Hunting:

• Search logs for job_id values that do not correspond to the user's own jobs.
• Look for file uploads with extensions like .php, .jsp, .asp, .sh in non-standard locations.

Lab Setup:

• Deploy Jumpserver v3.10.5 (vulnerable) in a sandboxed environment.
• Create a test user with file manager access.
• Use Burp Suite to intercept and modify requests.
• Monitor logs and file system for unauthorized uploads.

Indicators of Compromise (IOCs)

• File Paths: Unexpected files in web-accessible directories (e.g., /opt/jumpserver/data/ or /var/www/).
• Log Entries: Repeated job_id manipulation attempts in Jumpserver audit logs.
• Network Traffic: POST requests to /api/v1/files/bulk-upload/ with anomalous job_id values.
• File Hashes: Hashes of uploaded malicious files (e.g., PHP webshells).
• User Agents: Unusual user agents in file upload requests.

Detection Engineering

YARA Rule

rule CVE_2024_29024_Jumpserver_IDOR {
    meta:
        description = "Detects potential IDOR exploitation in Jumpserver file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29024"
    strings:
        $s1 = "/api/v1/files/bulk-upload/" ascii wide nocase
        $s2 = "job_id=" ascii wide nocase
        $s3 = ".php" ascii wide nocase
        $s4 = "<?php" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-29024 Jumpserver IDOR File Upload
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit IDOR in Jumpserver bulk file upload
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29024
logsource:
    category: webserver
    product: jumpserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/files/bulk-upload/'
        cs-uri-query|contains: 'job_id='
    condition: selection
falsepositives:
    - Legitimate bulk file transfers
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-29024 Jumpserver IDOR File Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/v1/files/bulk-upload/"; http_uri;
    content:"job_id="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jumpserver to version 3.10.6 or later.
2. If upgrade is not possible, restrict access to the file manager API endpoint (/api/v1/files/bulk-upload/) to trusted IPs only.
3. Implement additional access controls on job IDs (e.g., validate ownership server-side).

Long-term Measures:

• Conduct regular security audits of Jumpserver configurations.
• Monitor for unusual file upload patterns.
• Apply principle of least privilege to user roles.
• Enable detailed audit logging for file operations.

Workarounds:

• Disable the bulk file transfer feature if not needed.
• Use web application firewall (WAF) rules to block requests with manipulated job IDs.

Valters IT
Securing Your Digital Frontier