CVE-2021-39159: Remote Code Execution in BinderHub

Background

BinderHub is an open-source project that provides a platform for building and hosting interactive Jupyter notebooks. It allows users to create and share computational environments based on code repositories. BinderHub supports various repository providers, including GitHub, GitLab, Gist, Zenodo, Figshare, Hydroshare, and Dataverse. This vulnerability affects BinderHub versions prior to 0.2.0.

Vulnerability Detail

A remote code execution vulnerability has been discovered in BinderHub. By supplying malicious input, an attacker can execute arbitrary code within the BinderHub context. This can lead to the extraction of sensitive credentials, such as JupyterHub API tokens, Kubernetes service accounts, and Docker registry credentials. The attacker may gain the ability to manipulate images and user-created pods within the deployment, potentially escalating privileges depending on the underlying Kubernetes configuration. The vulnerability has a CVSS score of 9.6 (Critical).

pip install --upgrade "binderhub==0.2.0"

Workaround

As a temporary workaround, you can disable the git repo provider in BinderHub by specifying the BinderHub.repo_providers configuration. Here is an example of how to disable the git repo provider:

from binderhub.repoproviders import (GitHubRepoProvider,
                            GitLabRepoProvider, GistRepoProvider,
                            ZenodoProvider, FigshareProvider, HydroshareProvider,
                            DataverseProvider)

c.BinderHub.repo_providers =  {
            'gh': GitHubRepoProvider,
            'gist': GistRepoProvider,
            'gl': GitLabRepoProvider,
            'zenodo': ZenodoProvider,
            'figshare': FigshareProvider,
            'hydroshare': HydroshareProvider,
            'dataverse': DataverseProvider,
        }

By disabling the git repo provider, you remove the ability to create Binder environments from git repositories.

Conclusion

The remote code execution vulnerability in BinderHub can lead to severe consequences, including the extraction of sensitive credentials and potential privilege escalation. It is crucial to apply the provided patch or disable the git repo provider as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for binderhub →

FAQ