Unauthenticated WebSocket Proxying in Jupyter Server Proxy
Summary
CVE-2024-28179: Jupyter Server Proxy's Websocket Proxying does not require authentication. Affects jupyter-server-proxy across 2 version ranges.
< 3.2.3
>= 4.0.0, < 4.1.1
Fixed in 3.2.3 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Server Proxy is a package used to expose ports local to a Jupyter server to authenticated users by proxying web requests and websockets. It is commonly used in hosted environments, such as JupyterHub, to expose interactive applications and APIs to users. The vulnerability in Jupyter Server Proxy allows unauthenticated remote access to websocket endpoints, potentially leading to remote unauthenticated arbitrary code execution. This vulnerability affects the jupyter-server-proxy package.
Vulnerability Detail
The vulnerability in Jupyter Server Proxy arises from a lack of appropriate user authentication when proxying websockets. This allows anyone with network access to the Jupyter server endpoint to gain unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. Applications that rely on websockets, such as RStudio or remote Linux Desktop/VNC, are particularly vulnerable to remote unauthenticated arbitrary code execution. The vulnerability does not affect websocket endpoints exposed by Jupyter Server itself or projects that do not rely on websockets.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.33.2.3pip install --upgrade "jupyter-server-proxy==3.2.3" -
>= 4.0.0, < 4.1.14.1.1pip install --upgrade "jupyter-server-proxy==4.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The unauthenticated WebSocket proxying vulnerability in Jupyter Server Proxy allows remote unauthenticated access to websocket endpoints, potentially leading to arbitrary code execution. It is crucial to upgrade to a patched version of jupyter-server-proxy and restart any running Jupyter server to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jupyter-server-proxy →
FAQ
Jupyter Server Proxy is a package used to expose ports local to a Jupyter server to authenticated users by proxying web requests and websockets. It is commonly used in hosted environments, such as JupyterHub, to expose interactive applications and APIs to users.
The vulnerability allows unauthenticated remote access to websocket endpoints exposed via Jupyter Server Proxy. This can lead to remote unauthenticated arbitrary code execution, particularly in applications that rely on websockets.
Versions 0.0.1 to 3.2.2 and versions 4.0.0 and 4.1.0 of jupyter-server-proxy are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses Pipfile.lock to monitor and alert in real-time for open-source vulnerabilities without requiring access to the code or installation.
To fix the vulnerability, upgrade the jupyter-server-proxy package to a patched version (3.2.3 or above, excluding versions 4.0.0 and 4.1.0) and restart any running Jupyter server. Additionally, ensure that any dependent packages are also updated to non-vulnerable versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyter-server-proxy.
