{"vulnerability": "CVE-2024-40629", "sightings": [{"uuid": "d7f682f5-5316-42b2-be1c-0d118bc4ebdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-40629", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lla4xdhvqp2g", "content": "", "creation_timestamp": "2025-03-25T20:40:20.556946Z"}, {"uuid": "3440e89b-7c7b-49c5-a5d6-b2a87b31416a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-40629", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8766", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-40629\n\ud83d\udd25 CVSS Score: 10 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2024-07-18T17:04:10.251Z\n\ud83d\udccf Modified: 2025-03-25T19:59:14.014Z\n\ud83d\udd17 References:\n1. https://github.com/jumpserver/jumpserver/security/advisories/GHSA-3wgp-q8m7-v33v\n2. https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2", "creation_timestamp": "2025-03-25T20:24:36.000000Z"}, {"uuid": "164e6432-17d1-42e9-94a9-34aca3161195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-40629", "type": "seen", "source": "https://t.me/ViralCyber/4068", "content": "\u26a0\ufe0f\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0641\u0648\u0642 \u0628\u062d\u0631\u0627\u0646\u06cc \u0631\u0648\u06cc JumpServer\n\ud83d\udd34\u0634\u0627\u06cc\u062f \u0627\u0633\u0645 JumpServer \u0628\u0647 \u06af\u0648\u0634 \u0634\u0645\u0627 \u0622\u0634\u0646\u0627 \u0646\u0628\u0627\u0634\u062f. \u0627\u06cc\u0646 \u0645\u062d\u0635\u0648\u0644 \u06cc\u06a9 #PAM \u0645\u062a\u0646 \u0628\u0627\u0632 (Open Source) \u0627\u0633\u062a \u0648 \u062e\u06cc\u0644\u06cc \u0627\u0632 \u0633\u0627\u0632\u0645\u0627\u0646\u0647\u0627 \u0647\u0645 \u062f\u0631 \u0627\u06cc\u0631\u0627\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u06a9\u0646\u0646\u062f. \n\ud83d\udd34\u0627\u062e\u06cc\u0631\u0627 \u062f\u0648 #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc CVE-2024-40628 \u0648 CVE-2024-40629 \u0631\u0648\u06cc \u0627\u06cc\u0646 \u0645\u062d\u0635\u0648\u0644 \u0628\u0627 \u0627\u0645\u062a\u06cc\u0627\u0632 10 \u06a9\u0634\u0641 \u0634\u062f\u0647!\n\ud83d\udd34\u0639\u0645\u0642 \u0641\u0627\u062c\u0639\u0647 \u0627\u06cc\u0646\u062c\u0627\u0633\u062a \u06a9\u0647 \u0628\u0631\u062e\u06cc \u0627\u0632 PAM\u0647\u0627\u06cc \u0628\u0648\u0645\u06cc \u0631\u0648\u06cc #JumpServer  \u062a\u0648\u0633\u0639\u0647 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0646\u062f \u0648 \u0642\u0637\u0639\u0627 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0631\u0627 \u062f\u0627\u0631\u0646\u062f!\n\ud83d\udd34\u0627\u0645\u06cc\u062f\u0648\u0627\u0631\u06cc\u0645 \u0622\u0646 \u0645\u0627\u062c\u0631\u0627 \u06a9\u0647 \u0628\u0631\u0627\u06cc Mail Server\u0647\u0627\u06cc #\u0628\u0648\u0645\u06cc \u06a9\u0647 \u0628\u0631 \u0628\u0633\u062a\u0631 #Zimbra \u062a\u0648\u0633\u0639\u0647 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0648\u062f\u0646\u062f \u0627\u062a\u0641\u0627\u0642 \u0627\u0641\u062a\u0627\u062f \u062a\u06a9\u0631\u0627\u0631 \u0646\u0634\u0648\u062f!\n\n\u2709\ufe0f @PingChannel\n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\u00a0 \ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b\ud83d\udd2b", "creation_timestamp": "2024-08-01T17:20:44.000000Z"}, {"uuid": "e8f10a46-ce2c-4e6d-b720-06139ab3648b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-40629", "type": "seen", "source": "https://t.me/cvedetector/1166", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-40629 - JumpServer Ansible Playbook Arbitrary File Write RCE\", \n  \"Content\": \"CVE ID : CVE-2024-40629 \nPublished : July 18, 2024, 5:15 p.m. | 41\u00a0minutes ago \nDescription : JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. This issue has been patched in release versions 3.10.12 and 4.0.0. It is recommended to upgrade the safe versions. There are no known workarounds for this vulnerability. \nSeverity: 10.0 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-18T20:08:23.000000Z"}, {"uuid": "c3af3540-9cfa-4450-a2af-049ab4cc55c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-40629", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/6892", "content": "\u200aCVE-2024-40628 & CVE-2024-40629: Two Maximum Severity Flaws in JumpServer\n\nhttps://securityonline.info/cve-2024-40628-cve-2024-40629-two-maximum-severity-flaws-in-jumpserver/", "creation_timestamp": "2024-07-22T10:18:14.000000Z"}]}