CVE-2024-35225: jupyter-server-proxy Reflected XSS Vulnerability
Summary
CVE-2024-35225: Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Affects jupyter-server-proxy across 4 version ranges.
>= 3.0.0, < 3.2.4
>= 4.1.2, < 4.2.0
< 7abc9dc5bbb0b4b440548a5375261b8b8192fc22
< ff78128087e73fb9d0909e1366f8bf051e8ea878
Fixed in 3.2.4 or 4.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Server Proxy is an extension that allows users to run arbitrary external processes alongside their Jupyter notebook server and provides authenticated web access to these processes. It is widely used in data science and machine learning environments to facilitate the integration of various tools and services. However, certain versions of this package are vulnerable to a reflected cross-site scripting (XSS) issue, which can lead to unauthorized access and manipulation of user data.
Vulnerability Detail
The vulnerability arises from the '/proxy' endpoint, which accepts a 'host' path segment in the format '/proxy/<host>'. When an invalid 'host' value is provided, the response includes the unsanitized 'host' value. This allows an attacker to craft a phishing link containing malicious JavaScript. When a user clicks on this link, the browser executes the JavaScript, potentially compromising the user's JupyterLab instance and exposing sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.2.43.2.4pip install --upgrade "jupyter-server-proxy==3.2.4" -
>= 4.1.2, < 4.2.04.2.0pip install --upgrade "jupyter-server-proxy==4.2.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade the package, you can disable the jupyter-server-proxy extension as a temporary workaround. This can be done by running the following command: 'jupyter serverextension disable jupyter-server-proxy'.
Conclusion
The jupyter-server-proxy package has a reflected XSS vulnerability that can be exploited by attackers to execute arbitrary JavaScript in users' browsers. It is crucial to update to the patched versions or disable the extension to mitigate the risk. Regular monitoring of dependencies using tools like Vulert can help maintain security.
See every vulnerability recorded for jupyter-server-proxy →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a medium severity level.
Versions 3.x prior to 3.2.4 and 4.x prior to 4.2.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to unauthorized access to the user's JupyterLab instance and sensitive data.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyter-server-proxy.
