Affected configurations:
By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve the following:
To prevent cookie-tossing:
c.JupyterHub.subdomain_host = "https://mydomain.example.org"
c.JupyterHub.cookie_host_prefix_enabled = True
to enable domain-locked cookiesor, if available (applies to earlier JupyterHub versions):
c.JupyterHub.subdomain_host = "https://mydomain.example.org"
{ "nvd_published_at": "2024-03-27T19:15:48Z", "cwe_ids": [ "CWE-352", "CWE-565", "CWE-79" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-28T17:08:10Z" }