Jupyter Server Proxy has a reflected XSS issue in host parameter

Impact There is a reflected cross-site scripting XSS issue in jupyter-server-proxy1. The /proxy endpoint accepts a host path segment in the format /proxy/. When this endpoint is called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host, withou...

Jupyter Server Proxy Security Vulnerability

Jupyter Server Proxy is an open source library from JupyterHub that allows arbitrary external processes to be run alongside a laptop server. A security vulnerability exists in Jupyter Server Proxy prior to 3.2.4, versions prior to 4.2.0, which stems from a vulnerability that allows users to run...

The vulnerability of the Jupyter Server Proxy software, a tool for launching and proxying web applications, stems from the lack of authentication for a critical function. This allows attackers to execute arbitrary code.

The vulnerability of the Jupyter Server Proxy software for launching and proxying web applications is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Missing Websocket Authentication

Jupyter Server Proxy is vulnerable to Missing Websocket Authentication. The vulnerability is caused due to improper user authentication checks when proxying websockets within handlers.py. This allows an attacker to gain unauthenticated remote access to any websocket endpoint made accessible via t...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...

GHSA-W3VC-FX9P-WP4V Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...

Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...

Jupyter Server 安全漏洞

Jupyter Server is an application used by the Jupyter organization to provide back-end services for Jupyter Web applications. A security vulnerability exists in the Jupyter Server Proxy that stems from not properly checking user authentication, which could allow unauthenticated access by anyone wi...

PT-2024-2426 · Unknown · Jupyter Server Proxy

Name of the Vulnerable Software and Affected Versions: Jupyter Server Proxy versions prior to 3.2.3 Jupyter Server Proxy versions prior to 4.1.1 Description: The issue is related to the lack of proper user authentication when proxying websockets in Jupyter Server Proxy. This allows unauthenticate...

SSRF vulnerability in jupyter-server-proxy

Impact What kind of vulnerability is it? Server-Side Request Forgery SSRF Who is impacted? Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the allowedhos...

Server-Side Request Forgery (SSRF)

jupyterserverproxy is vulnerable to server side request forgery. The vulnerability exists due to a lack of validation of the allowedhosts allowing an attacker to bypass the authentication for terminal execution...

CVE-2022-21697

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery SSRF. Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of...

PYSEC-2022-16

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery SSRF. Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of...

CVE-2022-21697

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery SSRF. Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of...