CVE-2024-35225 Jupyter Server Proxy has a reflected XSS issue in host parameter

2024-06-1121:45:57

CWE-116

CWE-79

GitHub_M

www.cve.org

cve-2024-35225

jupyter server proxy

reflected xss

host parameter

security issue

web access

phishing

javascript

patch

upgrade

workaround

server operators

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.7%

JSON

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The /proxy endpoint accepts a host path segment in the format /proxy/<host>. When this endpoint is called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid host value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of GET /proxy/<host>, which runs the custom JavaScript contained in host set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user’s JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the jupyter-server-proxy extension.

CNA Affected

[
  {
    "vendor": "jupyterhub",
    "product": "jupyter-server-proxy",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.2.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.2.0",
        "status": "affected"
      }
    ]
  }
]