PyPI: jupyter-server-proxy
CVE-2024-35225
Safety vulnerability ID: SFTY-20240611-84050
Safety legacy ID: pyup.io-71837
Affected versions of Jupyter Server Proxy allow users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. A reflected cross-site scripting (XSS) issue exists in the /proxy endpoint, which accepts a host path segment in the format /proxy/<host>. When called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host without sanitization. This allows a third-party actor to send a phishing link with an invalid host value containing custom JavaScript to a user. When the user clicks the link, the browser renders the response, running the custom JavaScript. This issue permits extensive access to the user's JupyterLab instance for an actor. Patches are available, and as a workaround, server operators can disable the jupyter-server-proxy extension.
Overview
Jupyter Server Proxy has a reflected XSS issue in host parameter
Advisory
Affected versions of Jupyter Server Proxy allow users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. A reflected cross-site scripting (XSS) issue exists in the /proxy endpoint, which accepts a host path segment in the format /proxy/<host>. When called with an invalid host value, jupyter-server-proxy replies with a response that includes the value of host without sanitization. This allows a third-party actor to send a phishing link with an invalid host value containing custom JavaScript to a user. When the user clicks the link, the browser renders the response, running the custom JavaScript. This issue permits extensive access to the user's JupyterLab instance for an actor. Patches are available, and as a workaround, server operators can disable the jupyter-server-proxy extension.
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240611-84050/CVE-2024-35225
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr
- https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22
- https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
- https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
- https://nvd.nist.gov/vuln/detail/CVE-2024-35225
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-236.yaml
- https://github.com/advisories/GHSA-fvcq-4x64-hqxr
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more