GHSA-fvcq-4x64-hqxr

Source

https://github.com/advisories/GHSA-fvcq-4x64-hqxr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fvcq-4x64-hqxr

Aliases

Related

PYSEC-2024-236

Published

2024-06-11T21:12:47Z

Modified

2025-02-28T17:57:53.921349Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Jupyter Server Proxy has a reflected XSS issue in host parameter

Details

Impact

There is a reflected cross-site scripting (XSS) issue in jupyter-server-proxy[1]. The /proxy endpoint accepts a host path segment in the format /proxy/<host>. When this endpoint is called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid host value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of GET /proxy/<host>, which runs the custom JavaScript contained in host set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue exists in the latest release of jupyter-server-proxy, currently v4.1.2. Impacted versions: >=3.0.0,<=4.1.2

Patches

The patches are included in ==4.2.0 and ==3.2.4.

Workarounds

Server operators who are unable to upgrade can disable the jupyter-server-proxy extension with:

jupyter server extension disable jupyter-server-proxy

References

[1] : https://github.com/jupyterhub/jupyter-server-proxy/ [2] : https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyterserverproxy/handlers.py#L328

Database specific

{
    "github_reviewed_at": "2024-06-11T21:12:47Z",
    "nvd_published_at": "2024-06-11T22:15:09Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "severity": "CRITICAL"
}

References

Affected packages

PyPI / jupyter-server-proxy

Package

Name: jupyter-server-proxy; View open source insights on deps.dev
Purl: pkg:pypi/jupyter-server-proxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.2.4

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.1.0

3.2.0

3.2.1

3.2.2

3.2.3

PyPI / jupyter-server-proxy

Package

Name: jupyter-server-proxy; View open source insights on deps.dev
Purl: pkg:pypi/jupyter-server-proxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.2.0

Affected versions

4.*

4.0.0

4.1.0

4.1.1

4.1.2