CVE-2023-42820 jumpserver 任意用户密码重置漏洞浅析

web.title="jumpserver"

opt/jumpserver/apps/authentication/api/password.py    def create(self, request, *args, **kwargs):        token = request.GET.get('token')        userinfo = cache.get(token)        if not userinfo:            return HttpResponseRedirect(reverse('authentication:forgot-previewing'))        serializer = self.get_serializer(data=request.data)        serializer.is_valid(raise_exception=True)        username = userinfo.get('username')        form_type = serializer.validated_data['form_type']        code = random_string(6, lower=False, upper=False)        with open("/tmp/code","a") as f:            f.write(code+"n")        other_args = {}        target = serializer.validated_data[form_type]        if form_type == 'sms':            query_key = 'phone'            target = target.lstrip('+')        else:            query_key = form_type        user, err = self.is_valid_user(username=username, **{query_key: target})        if not user:            return Response({'error': err}, status=400)        subject = '%s: %s' % (get_login_title(), _('Forgot password'))        context = {            'user': user, 'title': subject, 'code': code,        }        message = render_to_string('authentication/_msg_reset_password_code.html', context)        other_args['subject'], other_args['message'] = subject, message        SendAndVerifyCodeUtil(target, code, backend=form_type, **other_args).gen_and_send_async()        return Response({'data': 'ok'}, status=200)

Python 3.11.4 (tags/v3.11.4:d2340ef, Jun  7 2023, 05:45:37) [MSC v.1934 64 bit (AMD64)] on win32Type "help", "copyright", "credits" or "license" for more information.>>> import random>>> random.seed(1010)>>> random.random()0.6710054770408643➜  chestnut python3Python 3.11.4 (main, Jun  7 2023, 10:13:09) [GCC 12.2.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import random>>> random.seed(1010)>>> random.random()0.6710054770408643>>>

def captcha_image(request, key, scale=1):    if scale == 2 and not settings.CAPTCHA_2X_IMAGE:        raise Http404    try:        store = CaptchaStore.objects.get(hashkey=key)    except CaptchaStore.DoesNotExist:        # HTTP 410 Gone status so that crawlers don't index these expired urls.        return HttpResponse(status=410)    random.seed(key)  # Do not generate different images for the same key    text = store.challenge

➜  chestnut docker top 808b  | grep pythonroot                5704                5674                0                   11:08               ?                   00:00:02            python jms start webroot                5864                5704                0                   11:08               ?                   00:00:01            /usr/local/bin/python /usr/local/bin/celery -A ops flower -logging=info --url_prefix=/core/flower --auto_refresh=False --max_tasks=1000 --state_save_interval=600000root                5865                5704                0                   11:08               ?                   00:00:00            /usr/local/bin/python /usr/local/bin/gunicorn jumpserver.asgi:application -b 0.0.0.0:8080 -k uvicorn.workers.UvicornWorker -w 4 --max-requests 10240 --max-requests-jitter 2048 --access-logformat %(h)s %(t)s %(L)ss "%(r)s" %(s)s %(b)s --access-logfile -root                5867                5865                0                   11:08               ?                   00:00:01            /usr/local/bin/python /usr/local/bin/gunicorn jumpserver.asgi:application -b 0.0.0.0:8080 -k uvicorn.workers.UvicornWorker -w 4 --max-requests 10240 --max-requests-jitter 2048 --access-logformat %(h)s %(t)s %(L)ss "%(r)s" %(s)s %(b)s --access-logfile -root                5868                5865                0                   11:08               ?                   00:00:02            /usr/local/bin/python /usr/local/bin/gunicorn jumpserver.asgi:application -b 0.0.0.0:8080 -k uvicorn.workers.UvicornWorker -w 4 --max-requests 10240 --max-requests-jitter 2048 --access-logformat %(h)s %(t)s %(L)ss "%(r)s" %(s)s %(b)s --access-logfile -root                5873                5865                0                   11:08               ?                   00:00:02            /usr/local/bin/python /usr/local/bin/gunicorn jumpserver.asgi:application -b 0.0.0.0:8080 -k uvicorn.workers.UvicornWorker -w 4 --max-requests 10240 --max-requests-jitter 2048 --access-logformat %(h)s %(t)s %(L)ss "%(r)s" %(s)s %(b)s --access-logfile -root                5874                5865                0                   11:08               ?                   00:00:02            /usr/local/bin/python /usr/local/bin/gunicorn jumpserver.asgi:application -b 0.0.0.0:8080 -k uvicorn.workers.UvicornWorker -w 4 --max-requests 10240 --max-requests-jitter 2048 --access-logformat %(h)s %(t)s %(L)ss "%(r)s" %(s)s %(b)s --access-logfile -