CVE-2024-40628

Executive Summary

CVE-2024-40628 is a critical vulnerability in Jumpserver, an open-source Privileged Access Management (PAM) tool. An attacker can exploit the ansible playbook functionality to read arbitrary files within the celery container, leading to sensitive information disclosure. The celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new admin account, or manipulate the database. The vulnerability has been addressed in versions 3.10.12 and 4.0.0. No known workarounds exist.

Supply Chain & Package Security

Jumpserver is a Python-based application distributed via GitHub and Docker images. The vulnerability exists in the core application code, not in a third-party package. However, the use of ansible playbooks introduces a risk of arbitrary file read. Users should verify the integrity of their Jumpserver installation and ensure they are using official releases.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

This vulnerability allows unauthenticated remote attackers to fully compromise the Jumpserver instance, including access to all managed host secrets and database manipulation.

Deep Dive & Mechanics

The vulnerability resides in the ansible playbook execution functionality within Jumpserver. The celery container, which processes background tasks, runs as root and has direct database access. An attacker can craft a malicious ansible playbook that includes file read operations (e.g., using the slurp module or cat command) to read arbitrary files from the container's filesystem.

The attack flow:

1. The attacker sends a crafted request to the Jumpserver API that triggers an ansible playbook execution.
2. The playbook includes a task that reads sensitive files (e.g., /etc/jumpserver/config.yml, database credentials, SSH keys).
3. The output of the playbook is returned to the attacker, revealing the file contents.
4. With database access, the attacker can extract all host secrets, create a new admin user, or modify database records.

The root cause is insufficient input validation and sanitization of ansible playbook content, allowing arbitrary file read operations.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.10.12 / pre-4.0.0): The vulnerable code likely does not restrict the ansible modules or commands that can be used in playbooks. For example, the playbook execution function may accept any valid ansible playbook without filtering dangerous modules like slurp, fetch, or command.

# Vulnerable: No restrictions on playbook content
def execute_playbook(playbook_content):
    # Directly executes the playbook
    result = ansible_runner.run(playbook=playbook_content)
    return result

Patched Code (3.10.12 / 4.0.0): The patched code likely implements a whitelist of allowed ansible modules or sanitizes the playbook to prevent file read operations. It may also restrict the playbook to only use specific modules like shell with limited commands.

# Patched: Whitelist allowed modules
ALLOWED_MODULES = ['command', 'shell', 'copy', 'template']

def execute_playbook(playbook_content):
    # Parse playbook and check modules
    for task in playbook_content['tasks']:
        module = task.get('module')
        if module not in ALLOWED_MODULES:
            raise ValueError(f"Module {module} not allowed")
    result = ansible_runner.run(playbook=playbook_content)
    return result

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Jumpserver instance (version < 3.10.12) using Docker:

   docker run -d --name jumpserver -p 8080:80 jumpserver/jumpserver:3.10.11
   

2. Access the web interface at http://localhost:8080.

Exploitation Steps:

1. Authenticate to Jumpserver (if required) or find an unauthenticated endpoint that triggers ansible playbook execution.
2. Craft a malicious playbook that reads sensitive files:

   - hosts: localhost
     tasks:
       - name: Read config file
         slurp:
           src: /etc/jumpserver/config.yml
         register: config
       - name: Exfiltrate data
         debug:
           msg: "{{ config['content'] | b64decode }}"
   

3. Send the playbook to the vulnerable endpoint (e.g., via API or web form).
4. Retrieve the output containing the base64-encoded file content.
5. Decode the content to obtain sensitive data (database credentials, SSH keys, etc.).
6. Use the database credentials to connect to the Jumpserver database and extract all host secrets or create a new admin account.

Blue Team

Detection:

• Monitor for unusual ansible playbook submissions, especially those containing slurp, fetch, or file modules.
• Alert on playbooks that attempt to read files outside of expected paths (e.g., /etc/, /var/lib/).
• Monitor database connections for unusual queries or new admin user creation.

Hunting:

• Search logs for playbook execution events with suspicious module names.
• Look for base64-encoded data in playbook outputs.
• Check for new user accounts created with admin privileges.

Indicators of Compromise (IOCs)

• File Paths: /etc/jumpserver/config.yml, /var/lib/jumpserver/, /root/.ssh/
• Network: Outbound connections from the Jumpserver container to attacker-controlled IPs
• Logs: Ansible playbook execution logs containing slurp, fetch, or file modules
• Database: New admin user accounts, modified host secrets
• Processes: Ansible runner processes with unusual arguments

Detection Engineering

YARA Rule

rule CVE_2024_40628_Ansible_Playbook_File_Read {
    meta:
        description = "Detects malicious ansible playbooks attempting file read via slurp or fetch modules"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-40628"
    strings:
        $slurp = "slurp" nocase
        $fetch = "fetch" nocase
        $file_read = /src:\s*["']?\/[^"']+/ nocase
        $b64decode = "b64decode" nocase
    condition:
        ($slurp or $fetch) and $file_read and $b64decode
}

Sigma Rule

title: CVE-2024-40628 Ansible Playbook File Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-40628 via malicious ansible playbooks
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: jumpserver
detection:
    selection:
        event: "playbook_execution"
        module: 
            - "slurp"
            - "fetch"
        src: 
            - "/etc/*"
            - "/var/lib/*"
            - "/root/*"
    condition: selection
falsepositives:
    - Legitimate administrative tasks using slurp/fetch
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40628 Jumpserver Ansible Playbook File Read"; flow:to_server; content:"slurp"; nocase; content:"src"; nocase; distance:0; pcre:"/src\s*:\s*["']?\/[^"']+/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jumpserver to version 3.10.12 or 4.0.0 immediately.
2. If upgrade is not possible, restrict network access to the Jumpserver API and web interface.
3. Monitor for suspicious ansible playbook submissions.

Long-term Mitigations:

• Implement strict input validation for ansible playbooks.
• Use a whitelist of allowed ansible modules.
• Run the celery container with reduced privileges (non-root).
• Implement database access controls and encryption at rest.
• Regularly audit user accounts and permissions.

Workarounds:

• No known workarounds exist. Upgrade is the only solution.

Valters IT