// For flags

CVE-2021-41194

Improper Access Control in jupyterhub-firstuseauthenticator

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For those who cannot upgrade, there is no complete workaround, but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until a patch or upgrade occurs.

FirstUseAuthenticator es un autentificador de JupyterHub que ayuda a los nuevos usuarios a establecer su contraseña en su primer acceso a JupyterHub. Cuando es usado JupyterHub con FirstUseAuthenticator, una vulnerabilidad en versiones anteriores a 1.0.0, permite el acceso no autorizado a la cuenta de cualquier usuario si "create_users=True" y el nombre de usuario es conocido o adivinado. Es posible actualizar a la versión 1.0.0 o aplicar un parche manualmente para mitigar la vulnerabilidad. Para aquellos que no puedan actualizar, no se presenta una solución completa, pero se presenta una mitigación parcial. Es posible deshabilitar la creación de usuarios con "c.FirstUseAuthenticator.create_users = False", que sólo permitirá el inicio de sesión con nombres de usuario totalmente normalizados para los usuarios ya existentes antes de jupyterhub-firstuserauthenticator versión 1.0.0. Si algún usuario nunca ha iniciado sesión con su nombre de usuario normalizado (es decir, en minúsculas), seguirá siendo vulnerable hasta que se aplique un parche o se actualice

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2021-10-28 CVE Published
  • 2024-07-13 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-284: Improper Access Control
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jupyterhub
Search vendor "Jupyterhub"
 First Use Authenticator
Search vendor "Jupyterhub" for product "First Use Authenticator"
 < 1.0.0
Search vendor "Jupyterhub" for product "First Use Authenticator" and version " < 1.0.0"
-
Affected