CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
An attacker can execute arbitrary code on a victim's computer by tricking them into opening a malicious notebook file due to insufficient input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32798?
CVE-2021-32798 is a critical cross-site scripting vulnerability in jupyter notebook, published on 9 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Weakness: CWE-79
Which versions are affected by CVE-2021-32798?
7 open source packages ship an affected version, including jupyter-base-notebook, jupyter-notebook and notebook. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyter-base-notebook Bitnami | From 5.7.0 | 5.7.11, 6.4.1 |
jupyter-notebook Bitnami | From 5.7.0 | 5.7.11, 6.4.1 |
notebook PyPI | All versions | 5.7.11 |
notebook PyPI | All versions | 5.7.11 |
notebook PyPI | From 5.7.0 | 5.7.11 |
notebook PyPI | From 6.0.0 | 6.4.1 |
1 more packages
notebook PyPI | From 6.0.0 | 6.4.1 |
Products include Jupyter Notebook.
How do I fix CVE-2021-32798?
Upgrade jupyter-base-notebook to a fixed version for your release line: 5.7.11 or 6.4.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-32798 being exploited?
There is no known exploitation of CVE-2021-32798 in the wild and no public exploit code.
Other vulnerabilities in jupyter notebook
- CVE-2018-8768 Jupyter Notebook file bypasses sanitization, executes JavaScript
- CVE-2022-24758 Insertion of Sensitive Information into Log File affects Jupyter Notebook
- CVE-2019-10856 Jupyter Notebook open redirect vulnerability
- CVE-2018-19351 Jupyter Notebook XSS via untrusted notebooks
- CVE-2018-19352 Jupyter Notebook XSS via directory name
Sources
Also known as BIT-jupyter-base-notebook-2021-32798, BIT-jupyter-notebook-2021-32798, DEBIAN-CVE-2021-32798, GHSA-hwvq-6gjx-j797, PYSEC-2021-118, UBUNTU-CVE-2021-32798.