¡¾Â©¶´Í¨¸æ¡¿JumpServer JINJA2×¢Èë´úÂëÖ´ÐЩ¶´£¨CVE-2024-29202£©

Ðû²¼Ê±¼ä 2024-04-01


Ò»¡¢Â©¶´¸ÅÊö

©¶´Ãû³Æ

    JumpServer   JINJA2×¢Èë´úÂëÖ´ÐЩ¶´

CVE   ID

CVE-2024-29202

©¶´ÀàÐÍ

×¢Èë

·¢ÏÖʱ¼ä

2024-03-29

©¶´ÆÀ·Ö

9.9

©¶´Æ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP

ÒѹûÈ»

ÔÚÒ°ÀûÓÃ

δ֪

 

JumpServerÊÇÒ»¿î¿ªÔ´µï±¤Ö÷»úºÍÔËάÄþ¾²Éó¼ÆÏµÍ³¡£

2024Äê3ÔÂ29ÈÕ£¬¶¶È¦Îª¶Ä¶øÉúVSRC¼à²âµ½JumpServerÖÐÐÞ¸´ÁËJINJA2×¢Èë´úÂëÖ´ÐЩ¶´£¨CVE-2024-29202£©£¬¸Ã©¶´µÄCVSSÆÀ·ÖΪ9.9¡£

JumpServer v3.0.0 - v3.10.6°æ±¾ÖдæÔÚ©¶´£¬¾ßÓеÍȨÏÞÓû§ÕÊ»§µÄ¹¥»÷Õß¿Éͨ¹ý¹¹½¨¶ñÒâplaybookÄ£°åÀûÓÃAnsibleÖеÄJinja2Ä£°å´úÂë×¢Èë©¶´ÔÚCeleryÈÝÆ÷ÖÐÖ´ÐÐÈÎÒâ´úÂë¡£ÓÉÓÚCeleryÈÝÆ÷ÒÔrootȨÏÞÔËÐв¢¾ßÓÐÊý¾Ý¿â·ÃÎÊȨÏÞ£¬Òò´Ë¹¥»÷Õß¿ÉÒÔ´ÓËùÓÐÖ÷»úÇÔÈ¡Ãô¸ÐÐÅÏ¢»òÀûÓÃÊý¾Ý¿â¡£

´ËÍ⣬JumpServerÖл¹ÐÞ¸´ÁËÒ»¸öÔ¶³Ì´úÂëÖ´ÐЩ¶´£¨CVE-2024-29201£¬CVSSÆÀ·Ö9.9£©£¬¾ßÓеÍȨÏÞÓû§ÕÊ»§µÄ¹¥»÷Õß¿Éͨ¹ý¹¹½¨¶ñÒâplaybookÄ£°åÈÆ¹ýAnsibleÖеÄÊäÈëÑéÖ¤»úÖÆ£¬´Ó¶øÔÚCeleryÈÝÆ÷ÖÐÖ´ÐÐÈÎÒâ´úÂë¡£


¶þ¡¢Â©¶´¸´ÏÖ

CVE-2024-29201¡¢CVE-2024-29202¸´ÏÖÈçÏ£º

image.png                                             

 

Èý¡¢Ó°Ï췶Χ

JumpServer v3.0.0 - v3.10.6

 

ËÄ¡¢Äþ¾²´ëÊ©

4.1 Éý¼¶°æ±¾

ĿǰÕâЩ©¶´ÒѾ­ÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½JumpServer v3.10.7»ò¸ü¸ß°æ±¾¡£

ÏÂÔØÁ´½Ó£º

https://github.com/jumpserver/jumpserver/releases

4.2 ÁÙʱ´ëÊ©

¹Ø±ÕÈÎÎñÖÐÐÄ£¬¿Éͨ¹ýSystem setting (ϵͳÉèÖÃ) - Feature£¨¹¦Ð§ÉèÖã© - Job Center£¨ÈÎÎñÖÐÐÄ) £¬Disable£¨¹Ø±Õ£©¡£

4.3 ͨÓý¨Òé

l  ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£

l  ¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼ÆÄ±£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£

l  ʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£

l  ¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏÞ¶È¡£

l  ÆôÓÃÇ¿ÃÜÂë¼ÆÄ±²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£

4.4 ²Î¿¼Á´½Ó

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj

 

 

Îå¡¢°æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

±¸×¢

V1.0

2024-04-02

Ê×´ÎÐû²¼

 

 

Áù¡¢¸½Â¼

6.1 ¶¶È¦Îª¶Ä¶øÉú¼ò½é

¶¶È¦Îª¶Ä¶øÉú½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶¶È¦Îª¶Ä¶øÉú´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬¶¶È¦Îª¶Ä¶øÉúÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Å¬Á¦¡£

6.2 ¹ØÓÚ¶¶È¦Îª¶Ä¶øÉú

¶¶È¦Îª¶Ä¶øÉúÄþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£

¹Ø×¢ÎÒÃÇ£º

image.png