CVE-2023-42442 PoC — JumpServer session replays download without authentication

Source

https://github.com/HolyGu/CVE-2023-42442

Associated Vulnerability

Title: JumpServer session replays download without authentication (CVE-2023-42442)
Description:JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).

Readme

## 红队攻防之JumpServer未授权访问漏洞(CVE-2023-42442)后利用过程分享

使用方法：go run CVE-2023-42442.go --url http://192.168.123.120

详见微信公众号文章：https://mp.weixin.qq.com/s/NCSnTsOMxslmf5S6d9896A

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →