CVE-2024-29201
Published: 29 March 2024
Summary
CVE-2024-29201 is a critical-severity Code Injection (CWE-94) vulnerability in Fit2Cloud Jumpserver. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
JumpServer, an open source bastion host and operations security audit platform, contains a code injection vulnerability tracked as CVE-2024-29201. The flaw resides in the input validation logic of its Ansible integration and allows an authenticated user to execute arbitrary commands inside the Celery container, which runs with root privileges and has direct database access.
An attacker with low-privileged access can exploit the weakness over the network to bypass validation checks, run code within the Celery container, and thereby exfiltrate credentials or other sensitive data stored for all managed hosts or alter database contents. The CVSS 3.1 score of 9.9 reflects the combination of network reachability, low attack complexity, and high impact on confidentiality, integrity, and availability across container boundaries.
The official GitHub Security Advisory and accompanying SonarSource analysis state that the issue is resolved in JumpServer version 3.10.7; administrators are advised to upgrade immediately and verify that Celery containers are rebuilt from the patched release.
The associated EPSS score has reached a peak of 0.7307 with a current value of 0.6649, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26219
Vulnerability details
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root…
more
privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.