Impact

An attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions.

Details

JumpServer provides an API for the KoKo component to validate user private key logins. This API does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions.

Reproduction steps

1. Create a test instance of JumpServer and login as the admin user.
2. Add an SSH public key on the /ui/#/profile/setting?activeTab=SSHUpdate
   page, e.g. one from the example GitHub link above.
3. Logout.
4. Generate an API token with the request:

   curl http://localhost/api/v1/authentication/tokens/ -H "Content-Type:
   application/json" -d '{"username": "admin", "public_key": "SSH_PUBLIC_KEY"}'

Patches

Safe versions:

• v2.28.20
• v3.7.1

Workarounds

It is recommended to upgrade the safe versions.

After the upgrade, token could not be create by public key

References

Thanks for Oskar Zeino-Mahmalat of Sonar found and report this vulnerability