Description

Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T15:17:22.270Z",
  "pubdate": "2026-11-06T15:17:22.270Z",
  "executiveSummary": "Jumis (formerly Tildes Jumis) on-premise installations are susceptible to a critical authentication bypass vulnerability due to the use of a deterministic, client-side password derivation algorithm for a high-privilege SQL Server login.\nThe application creates a sysadmin-privileged login account, ##Tilde_JumisAdmin##, whose credentials are generated using a hard-coded secret key and the publicly discoverable Microsoft SQL Server instance name.\nThis vulnerability allows an unauthenticated remote attacker to calculate the administrator password offline. Successful exploitation results in full sysadmin-level control over the SQL Server instance, enabling unauthorized access to all hosted accounting databases.\nFurthermore, because the application programmatically enables the 'xp_cmdshell' stored procedure, successful authentication grants the attacker full operating-system command execution privileges on the underlying host server.\nThe risk is critical, as no prior authentication is required, and the exploitation process relies only on network reachability to the SQL Server instance.",
  "technicalDetails": "The root cause of this vulnerability is a design flaw involving the storage and generation of credentials within the Jumis application infrastructure. The system creates a SQL Server login named ##Tilde_JumisAdmin##, which is assigned the sysadmin fixed server role by default.\nAuthentication to this account relies on a password derivation algorithm hard-coded within the Jumis client application binaries. This algorithm consumes only the Microsoft SQL Server @@servername as input, which is combined with a hard-coded, static secret key to produce the password.\nBecause the server name is not a secret and can be trivially discovered through reconnaissance techniques—such as querying the SQL Server Browser service (UDP 1434), analyzing TDS pre-login responses, or via DNS/NetBIOS enumeration—the password is effectively deterministic and predictable for any given installation.\nThe attack flow proceeds as follows: 1. An attacker identifies the target SQL Server instance and retrieves the @@servername via standard network reconnaissance. 2. The attacker performs static analysis on the Jumis client application to extract the hard-coded derivation algorithm and the static secret key. 3. The attacker computes the password for the ##Tilde_JumisAdmin## account offline using the retrieved server name. 4. The attacker connects to the SQL Server using the discovered credentials, bypassing the authentication mechanism entirely.\nUpon establishing a session as ##Tilde_JumisAdmin##, the attacker inherits sysadmin privileges. This allows for unrestricted read/write access to all databases residing on the instance. Additionally, since the application routinely enables 'xp_cmdshell' during its operational lifecycle, an attacker can leverage this stored procedure to execute arbitrary OS-level commands with the service account's permissions. This enables full server compromise, lateral movement within the network, and complete data exfiltration. The vulnerability persists across all on-premise installations that utilize this authentication architecture."
}