Impact

Session replays can download without authentication。

The affected versions: v3.0.0 - v3.6.3.
If Your session replays store in S3 or OSS or other cloud storage，not affected.

Details

The api /api/v1/terminal/sessions/ permission control is broken and can be accessed anonymously.

# https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91
...
class SessionViewSet(OrgBulkModelViewSet):
     permission_classes = [RBACPermission | IsSessionAssignee]   
...

# https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/permissions.py#L10
class IsSessionAssignee(permissions.BasePermission):
    def has_object_permission(self, request, view, obj):
         ...

class BasePermission:
    def has_permission(self, request, view):
          return True
 

SessionViewSet permission classes set to [RBACPermission | IsSessionAssignee], relation is or, so any permission matched will be allowed. IsSessionAssignee inherit from BasePermission, BasePermission default has_permission set to True，and not awared this at that time.

To prevent the vulnerability from being exploited, the more details are withheld for now.

Patches

Safe versions: v3.6.4，v3.5.5

Workarounds

It is recommended to upgrade the safe versions.

After upgrade, visit the api $HOST/api/v1/terminal/sessions/?limit=1, the expected http response code is 401 (not_authenticated).