PyPI: jupyter-server
CVE-2024-35178
Safety vulnerability ID: SFTY-20240606-35352
Safety legacy ID: pyup.io-71628
Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This only affects Windows users
Overview
Jupyter server on Windows discloses Windows user password hash
Advisory
Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This only affects Windows users
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240606-35352/CVE-2024-35178
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35178
- https://github.com/advisories/GHSA-hrw6-wg82-cm62
- https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62
- https://nvd.nist.gov/vuln/detail/CVE-2024-35178
- https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2024-165.yaml
- https://github.com/advisories/GHSA-hrw6-wg82-cm62
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more