CVE-2023-28110: JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

Vulnerability summary

CVE-2023-28110 is a critical (CVSS 9.9) vulnerability in fit2cloud jumpserver. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 58.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-03-2023
   PublishedVulnerability first disclosed.
2. 25-02-2025
   Last modifiedVulnerability information updated.

Description

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.

• CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.