{"id":"CVE-2023-43651","aliases":["GHSA-4r5x-x283-wm96"],"title":"Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell ","summary":"Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell ","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","vendor":"jumpserver","product":"github.com/jumpserver/koko","ecosystem":"go","affected":["github.com/jumpserver/koko >= 2.0.0, < 2.28.20","github.com/jumpserver/koko >= 3.0.0, < 3.7.1"],"patched":["github.com/jumpserver/koko 2.28.20","github.com/jumpserver/koko 3.7.1"],"published":"2023-10-24","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:24.676538248Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4r5x-x283-wm96","references":[{"url":"https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43651"},{"url":"https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2"},{"url":"https://github.com/jumpserver/koko/commit/857f8b9e41f0930dc6190a35d8601fffa5e884e7"},{"url":"https://github.com/jumpserver/koko"}],"tags":["osv","go"],"epss":0.01716,"epssPercentile":0.76451,"ingestedAt":"2026-09-12T03:13:01.753Z","slug":"CVE-2023-43651","body":"## Overview\n\n### Impact\n\nAn authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the host system.\n\n### Details\nThrough the WEB CLI interface provided by koko, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.\n\n```\nadmin> const { execSync } = require(\"child_process\")\nadmin> console.log(execSync(\"id; hostname;\").toString())\nuid=0(root) gid=0(root) groups=0(root)\njms_koko\nadmin> \n```\n\n### Patches\nSafe versions: \n- v2.28.20\n- v3.7.1 \n\n### Workarounds\nIt is recommended to upgrade the safe versions.\n\nAfter upgrade, you can use the same method to check whether the vulnerability is fixed.\n```\nadmin> console.log(execSync(\"id; hostname;\").toString())\n/bin/sh: line 1: /bin/hostname: Permission denied\n```\n\n### References\nThanks for **Oskar Zeino-Mahmalat** of [Sonar](https://sonarsource.com/) found and report this vulnerability \n\n## Affected packages\n\n- `github.com/jumpserver/koko >= 2.0.0, < 2.28.20`\n- `github.com/jumpserver/koko >= 3.0.0, < 3.7.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/jumpserver/koko 2.28.20`\n- `github.com/jumpserver/koko 3.7.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.2,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}