CVE-2023-42818 : Security Advisory and Response

This article provides detailed information about CVE-2023-42818, a vulnerability affecting JumpServer due to SSH public key login without private key challenge if MFA is enabled in the jump server.

Understanding CVE-2023-42818

This section delves into what CVE-2023-42818 entails, from its description to its impact and mitigation strategies.

What is CVE-2023-42818?

JumpServer is an open-source bastion host software. This CVE arises when users enable Multi-Factor Authentication (MFA) and utilize a public key for authentication, but the Koko SSH server fails to verify the corresponding SSH private key. It allows attackers to potentially brute-force authentication against the SSH service using a disclosed public key. The vulnerability has been addressed in versions 3.6.5 and 3.5.6, and users are strongly recommended to update to these patched versions.

The Impact of CVE-2023-42818

The vulnerability poses a moderate threat with a CVSS v3.1 base severity score of 5.4, indicating a medium severity level. The attack complexity is low, requiring no special privileges, and user interaction is necessary. While confidentiality impact is none, integrity impact stands low, and availability impact is also low, keeping the overall risk manageable.

Technical Details of CVE-2023-42818

This section explores technical aspects such as the vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability in JumpServer allows unauthorized access via SSH public key authentication without verifying the corresponding private key, potentially leading to unauthorized system access.

Affected Systems and Versions

JumpServer versions >= 3.6.0 and < 3.6.5, along with versions < 3.5.6, are impacted by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by using a disclosed public key to attempt brute-force authentication against the SSH service.

Mitigation and Prevention

In this section, we highlight steps to take to mitigate the risk of CVE-2023-42818 and prevent future occurrences.

Immediate Steps to Take

Users should update their JumpServer installations to versions 3.6.5 and 3.5.6 to eliminate the vulnerability. Additionally, it is crucial to revoke any publicly disclosed SSH public keys to prevent unauthorized access.

Long-Term Security Practices

Regularly updating software and implementing secure authentication methods are essential for maintaining system security. Conducting security audits and monitoring for unauthorized access attempts can also enhance overall security posture.

Patching and Updates

Stay informed about security patches and updates released by JumpServer. Promptly apply these patches to ensure your system is protected against known vulnerabilities.