Sensitive Information Exposure in Jupyter Server - CVE-2022-24757
Summary
CVE-2022-24757: The Jupyter Server provides the backend (i.e. Affects jupyter-server versions < a5683aca0b0e412672ac6218d09f74d44ca0de5a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Server is a powerful backend service that supports Jupyter web applications, providing essential APIs and REST endpoints for interactive computing. It allows users to run notebooks, manage kernels, and serve content over the web. However, prior to version 1.15.4, Jupyter Server had a critical vulnerability that could expose sensitive information through server logs, making it susceptible to unauthorized access.
Vulnerability Detail
The vulnerability, identified as CVE-2022-24757, arises from the logging mechanism in Jupyter Server. When a 5xx error occurs, the server logs contain sensitive information, including authentication cookies and header values. Since these logs do not require root access to view, an attacker could exploit this by monitoring the logs to steal sensitive authentication information, potentially gaining unauthorized access to the Jupyter server. This issue affects multiple versions of Jupyter Server across various Debian ecosystems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version of Jupyter Server.
Conclusion
CVE-2022-24757 is a significant vulnerability in Jupyter Server that exposes sensitive information through server logs. Users are strongly advised to upgrade to version 1.15.4 or later to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for jupyter-server →
FAQ
CVE-2022-24757 is a vulnerability in Jupyter Server that allows unauthorized access to sensitive information through server logs.
If you are running a version prior to 1.15.4, your Jupyter Server is vulnerable to this issue.
An attacker could potentially gain unauthorized access to the Jupyter server by stealing sensitive authentication information from the logs.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code directly.
The CVSS score for CVE-2022-24757 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jupyter-server.
