Arbitrary Code Execution in IPython Notebook
Summary
CVE-2014-3429: IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. Affects ipython versions < 1.2.0~rc1-1. Fixed in 1.2.0~rc1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython Notebook is an interactive computational environment for creating and sharing documents containing live code, equations, visualizations, and explanatory text. It allows users to create notebooks that combine code execution, rich text, mathematics, plots, and media. IPython Notebook versions 0.12 through 1.x before 1.2 are affected by a vulnerability that allows remote attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability (CVE-2014-3429) in IPython Notebook arises from the lack of origin validation for websocket requests. This allows an attacker with knowledge of the kernel id and a crafted page to execute arbitrary code. By exploiting this vulnerability, an attacker can gain unauthorized access to the system and potentially perform malicious actions.
How To Fix
Minimum fixed version
1.2.0~rc1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ipythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in IPython Notebook allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. It is crucial to upgrade to the recommended version to mitigate the risk of unauthorized access and potential malicious actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipython →
FAQ
IPython Notebook is an interactive computational environment for creating and sharing documents containing live code, equations, visualizations, and explanatory text.
IPython Notebook versions 0.12 through 1.x before 1.2 are affected by this vulnerability.
An attacker with knowledge of the kernel id and a crafted page can exploit this vulnerability to execute arbitrary code.
By exploiting this vulnerability, an attacker can gain unauthorized access to the system and potentially perform malicious actions.
To fix this vulnerability, upgrade IPython Notebook to version 1.2.0~rc1-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
