Loading vulnerability…
A broken permission control vulnerability exists in JumpServer versions 3.0.0 up to (but not including) 3.5.5 and 3.6.4, where the /api/v1/terminal/sessions/ endpoint allows unauthenticated access to session replays. The permission classes for the SessionViewSet are set to [RBACPermission | IsSessionAssignee], and the use of the logical OR allows access if either condition is met, effectively allowing anonymous users to download session replays. This affects session replays stored locally; those stored in S3, OSS, or other cloud storage are not impacted.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a Python-based exploit tool ('blackjump.py') targeting multiple vulnerabilities in JumpServer, a bastion host management platform. The tool supports three main exploit modules: (1) CVE-2023-42820, which allows unauthorized password reset for any user if the username and email are known; (2) CVE-2023-42442, which enables unauthorized download of all operation video recordings from the server; and (3) an RCE module (2021) that allows remote command execution without authentication. The tool is operated via command-line arguments, specifying the exploit module and the target JumpServer URL. The code interacts with specific JumpServer HTTP endpoints to perform the exploits, and outputs results such as new passwords or downloaded files. The repository contains a single main code file, a requirements file for dependencies, and documentation in both Chinese and English. The exploit is operational and provides real attack capabilities against vulnerable JumpServer instances.
This repository provides exploit code for CVE-2023-42442, a vulnerability in JumpServer that allows unauthenticated attackers to enumerate session information and download session replay files (recordings) due to a combination of an unauthenticated API and directory traversal. The repository contains two main exploit scripts: one in Go (CVE-2023-42442.go) and one in Python (CVE-2023-42442.py). Both scripts operate similarly: they first query the /api/v1/terminal/sessions/ endpoint to retrieve session metadata, then construct download URLs for replay files using the /media/xpack/../replay/{date}/{session_id}.{ext} path, where {ext} is .cast.gz or .replay.gz depending on the protocol. The scripts then download these files and package them into tar archives for offline analysis. The exploit is operational and automates the process of extracting sensitive session recordings from vulnerable JumpServer instances. No payload for code execution is included; the exploit is focused on unauthorized data access and exfiltration.
This repository contains a Go-based exploit for JumpServer's CVE-2023-42442, an unauthorized access vulnerability. The main file, CVE-2023-42442.go, is a standalone script that takes a target URL as input and performs the following steps: (1) queries the /api/v1/terminal/sessions/ endpoint to retrieve the latest session metadata, (2) downloads the associated session replay file (either .replay.gz or .cast.gz depending on protocol), (3) saves both the session metadata and replay file locally, and (4) packages them into a tar archive. The exploit leverages the lack of authentication on the relevant endpoints to extract sensitive session data from the target JumpServer instance. The repository also includes a README.md with usage instructions and a reference to a WeChat article for further details. No hardcoded IPs or domains are present; the target is specified at runtime. The exploit is operational and demonstrates post-exploitation data extraction from a vulnerable JumpServer.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.