CVE-2023-43651

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1

Description An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.

Recommendations For JumpServer versions prior to 2.28.20, upgrade to version 2.28.20 or later. For JumpServer versions prior to 3.7.1, upgrade to version 3.7.1 or later. As a temporary workaround, consider restricting access to the WEB CLI interface provided by the koko component until a patch is applied. Avoid using the execSync function in the authorized mongoDB database to minimize the risk of exploitation.