CVE-2024-37300

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Severity Score

8.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.

OAuthenticator es un software que permite conectar y utilizar proveedores de identidad OAuth2 con JupyterHub. JupyterHub < 5.0, cuando se usa con `GlobusOAuthenticator`, se puede configurar para permitir solo a todos los usuarios de una institución en particular. Esto funcionó bien antes de JupyterHub 5.0, porque "allow_all" no tenía prioridad sobre "identity_provider". Desde JupyterHub 5.0, "allow_all" tiene prioridad sobre "identity_provider". En un centro con la misma configuración, ahora todos los usuarios podrán iniciar sesión, independientemente del `identity_provider`. Básicamente, `identity_provider` será ignorado. Este es un cambio documentado en JupyterHub 5.0, pero es probable que tome por sorpresa a muchos usuarios. OAuthenticator 16.3.1 soluciona el problema con JupyterHub 5.0 y no afecta a las versiones anteriores. Como workaround, no actualice a JupyterHub 5.0 cuando utilice `GlobusOAuthenticator` en la configuración anterior.

*Credits: N/A

CVSS Scores

GitHubv3.1 8.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-06-05 CVE Reserved
2024-06-12 CVE Published
2024-06-13 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-863: Incorrect Authorization

CAPEC

References (3)

URL	Tag	Source
https://github.com/jupyterhub/oauthenticator/commit/d1aea05fa89f2beae15ab0fa0b0d071030f79654	X_refsource_misc
https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-gprj-3p75-f996	X_refsource_confirm
https://jupyterhub.readthedocs.io/en/stable/howto/upgrading-v5.html#authenticator-allow-all-and-allow-existing-users	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Jupyterhub Search vendor "Jupyterhub"		Oauthenticator Search vendor "Jupyterhub" for product "Oauthenticator"				< 16.3.1 Search vendor "Jupyterhub" for product "Oauthenticator" and version " < 16.3.1"		en		Affected