Information Disclosure

notebook is vulnerable to information disclosure. Authenticated attackers are able to access sensitive files, when the server root directory’s only protection from the server is being hidden. The issue is there because the requests directed through ContentsManager.allow_hidden = False command only prevents listing the contents of hidden directories, but does not block accessing individual hidden files or files in hidden directories. Hence any authenticated requests would be able to access files if their names are guessable.