CVE-2024-28179

Jupyter Server Proxy's Websocket Proxying does not require authentication

Severity Score

9.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.

Jupyter Server Proxy permite a los usuarios ejecutar procesos externos arbitrarios junto con sus servidores portátiles Jupyter y proporciona acceso web autenticado. Antes de las versiones 3.2.3 y 4.1.1, Jupyter Server Proxy no verificaba adecuadamente la autenticación del usuario al utilizar websockets, lo que permitía el acceso no autenticado a cualquier persona que tuviera acceso de red al endpoint del servidor Jupyter. Esta vulnerabilidad puede permitir el acceso remoto no autenticado a cualquier endpoint de websocket configurado para ser accesible a través de Jupyter Server Proxy. En muchos casos, esto conduce a la ejecución remota de código arbitrario no autenticado, debido a cómo las instancias afectadas usan websockets. Los endpoints de websocket expuestos por el propio `jupyter_server` no se ven afectados. Los proyectos que no dependen de websockets tampoco se ven afectados. Las versiones 3.2.3 y 4.1.1 contienen una solución para este problema.

*Credits: N/A

CVSS Scores

GitHubv3.1 9.0

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-06 CVE Reserved
2024-03-20 CVE Published
2024-03-21 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-306: Missing Authentication for Critical Function

CAPEC

References (4)

URL	Tag	Source
https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433	X_refsource_misc
https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9	X_refsource_misc
https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03	X_refsource_misc
https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Jupyterhub Search vendor "Jupyterhub"		Jupyter-server-proxy Search vendor "Jupyterhub" for product "Jupyter-server-proxy"				>= 4.0.0 < 4.1.1 Search vendor "Jupyterhub" for product "Jupyter-server-proxy" and version " >= 4.0.0 < 4.1.1"		en		Affected
Jupyterhub Search vendor "Jupyterhub"		Jupyter-server-proxy Search vendor "Jupyterhub" for product "Jupyter-server-proxy"				< 3.2.3 Search vendor "Jupyterhub" for product "Jupyter-server-proxy" and version " < 3.2.3"		en		Affected