CVE-2023-42819

Deeper analysis

JumpServer, an open source bastion host, contains a path traversal vulnerability (CWE-22) that permits authenticated users to read or write arbitrary files on the underlying system. The flaw resides in the Job-Template playbook handling code; an attacker who creates a playbook obtains its identifier and can then supply a crafted key parameter containing directory traversal sequences to the /api/v1/ops/playbook/{id}/file/ endpoint.

A logged-in user can therefore retrieve sensitive files such as /etc/passwd or overwrite configuration and code files, resulting in full system compromise. The attack requires only low-privileged access and no user interaction beyond the initial authenticated session, producing a CVSS 3.1 score of 8.9.

The maintainers addressed the issue in version 3.6.5; the corresponding GitHub security advisory and commit confirm that no workarounds exist and recommend immediate upgrade. The EPSS score has reached a peak of 0.4229 with a current value of 0.3813, indicating sustained but not sharply escalating exploitation interest since disclosure.