CVE-2020-26261 user-readable api tokens in systemd units
Attackers can read user API tokens from systemd unit environments, potentially leading to account takeover in JupyterHub deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26261?
CVE-2020-26261 is a high-severity vulnerability in jupyterhub systemdspawner, published on 9 Dec 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Weakness: CWE-668
Which versions are affected by CVE-2020-26261?
3 open source packages ship an affected version, including jupyterhub-systemdspawner. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub-systemdspawner PyPI | All versions | 0.15.0 |
jupyterhub-systemdspawner PyPI | All versions | 0.15.0 |
jupyterhub-systemdspawner PyPI | All versions | 0.15.0 |
Products include Jupyterhub Systemdspawner.
How do I fix CVE-2020-26261?
Upgrade jupyterhub-systemdspawner to 0.15.0 or later.
Is CVE-2020-26261 being exploited?
There is no known exploitation of CVE-2020-26261 in the wild and no public exploit code.
Sources
Also known as GHSA-cg54-gpgr-4rm6, PYSEC-2020-52.