jumpserver session泄露（CVE-2023-42442）

### Impact Session replays can download without authentication。 The affected versions: v3.0.0 - v3.6.3. If Your session replays store in S3 or OSS or other cloud storage，not affected. ### Details The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. # https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/api/session/session.py#L91 ... class SessionViewSet(OrgBulkModelViewSet): permission_classes = [RBACPermission | IsSessionAssignee] ... # https://github.com/jumpserver/jumpserver/blob/v3.6.1/apps/terminal/permissions.py#L10 class IsSessionAssignee(permissions.BasePermission): def has_object_permission(self, request, view, obj): ... class BasePermission: def has_permission(self, request, view): return True **SessionViewSet** permission classes set to **\[RBACPermission | IsSessionAssignee\]**, relation is or, so any permission matched will be allowed. **IsSessionAssignee** inherit from **BasePermission**, BasePermission default has\_permission set to True，and not awared this at that time. To prevent the vulnerability from being exploited, the more details are withheld for now. ### Patches Safe versions: v3.6.4，v3.5.5 ### Workarounds It is recommended to upgrade the safe versions. After upgrade, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`, the expected http response code is 401 (not\_authenticated).