CVE-2023-43651: Github.com/jumpserver/koko Remote Code Execution Vulnerability
MODERATECVE-2023-43651 is a MODERATE (CVSS 6.4) remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Github.com/jumpserver/koko libraries in the Go ecosystem. The issue involves jumpserver koko vulnerable to remote code execution on the host system via mongodb shell. Remediation is available by upgrading affected packages to version 2.28.20, 3.7.1.
CVE-2023-43651 at a Glance
Security Impact
CVSS: 6.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H).
How to Fix CVE-2023-43651
To remediate this vulnerability, upgrade all affected Github.com/jumpserver/koko dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/jumpserver/koko to 2.28.20Upgrade github.com/jumpserver/koko to 3.7.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/jumpserver/kokoHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-43651, inspect your project dependencies for Github.com/jumpserver/koko:
inspect dependencies for github.com/jumpserver/kokoAnalyze the terminal output to locate any version of Github.com/jumpserver/koko in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.28.20), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Github.com/jumpserver/koko, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-43651 Affected Github.com/jumpserver/koko Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/jumpserver/koko
|
Go |
≥ 2.0.0
< 2.28.20
|
2.28.20
|
|
github.com/jumpserver/koko
|
Go |
≥ 3.0.0
< 3.7.1
|
3.7.1
|
References
Frequently Asked Questions
What is CVE-2023-43651?
Which Github.com/jumpserver/koko versions are affected?
What version fixes CVE-2023-43651?
Is github.com/jumpserver/koko affected?
What is the CVSS score of CVE-2023-43651?
What CWE is associated with CVE-2023-43651?
How can I check Go dependencies for CVE-2023-43651?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4r5x-x283-wm96",
"modified" : "2023-10-24T19:47:50Z",
"published" : "2023-10-24T19:47:50Z",
"aliases" : [ "CVE-2023-43651" ],
"summary" : "Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell ",
"details" : "### Impact\n\nAn authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the host system.\n\n### Details\nThrough the WEB CLI interface provided by koko, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.\n\n```\nadmin> const { execSync } = require(\"child_process\")\nadmin> console.log(execSync(\"id; hostname;\").toString())\nuid=0(root) gid=0(root) groups=0(root)\njms_koko\nadmin> \n```\n\n### Patches\nSafe versions: \n- v2.28.20\n- v3.7.1 \n\n### Workarounds\nIt is recommended to upgrade the safe versions.\n\nAfter upgrade, you can use the same method to check whether the vulnerability is fixed.\n```\nadmin> console.log(execSync(\"id; hostname;\").toString())\n/bin/sh: line 1: /bin/hostname: Permission denied\n```\n\n### References\nThanks for **Oskar Zeino-Mahmalat** of [Sonar](https://sonarsource.com/) found and report this vulnerability ",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/jumpserver/koko"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.28.20"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/jumpserver/koko"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.7.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-43651"
}, {
"type" : "WEB",
"url" : "https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2"
}, {
"type" : "WEB",
"url" : "https://github.com/jumpserver/koko/commit/857f8b9e41f0930dc6190a35d8601fffa5e884e7"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jumpserver/koko"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-94" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-10-24T19:47:50Z",
"nvd_published_at" : "2023-09-27T21:15:10Z"
}
}