-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from database client connectors (MongoDB/PostgreSQL/Redis/SQL Server) executing CLI tools with excessive privileges. The patch adds BuildNobodyWithOpts to run these clients with reduced 'nobody' user permissions. The original implementations in conn_*.go files called localcommand.New without user context restrictions, allowing authenticated users to leverage database shells' native command execution capabilities (e.g., MongoDB's execSync) with host system root privileges. The entrypoint.sh permission changes and addition of conn_nobody.go confirm the privilege escalation vector.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/jumpserver/koko | go | >= 2.0.0, < 2.28.20 | 2.28.20 |
| github.com/jumpserver/koko | go | >= 3.0.0, < 3.7.1 | 3.7.1 |
Ongoing coverage of React2Shell