CVE-2024-22421 Potential authentication and CSRF tokens leak in JupyterLab
Attackers can steal authentication and CSRF tokens from JupyterLab users via malicious links, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22421?
CVE-2024-22421 is a high-severity vulnerability in Fedoraproject Fedora, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
Which versions are affected by CVE-2024-22421?
11 open source packages ship an affected version, including jupyterlab, jupyter-base-notebook and jupyter-notebook. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
jupyterlab Bitnami | All versions | 3.6.7, 4.0.11 |
jupyterlab PyPI | All versions | 3.6.7, 4.0.11 |
jupyterlab PyPI | All versions | 3.6.7 |
jupyterlab PyPI | All versions | 3.6.7 |
jupyterlab PyPI | From 4.0.0 | 4.0.11 |
jupyterlab PyPI | From 4.0.0 | 4.0.11 |
5 more packages
jupyter-base-notebook Bitnami | From 7.0.0 | 7.0.7 |
jupyter-notebook Bitnami | From 7.0.0 | 7.0.7 |
notebook PyPI | From 7.0.0 | 7.0.7 |
notebook PyPI | From 7.0.0 | 7.0.7 |
notebook PyPI | From 7.0.0 | 7.0.7 |
Products include Fedoraproject Fedora, Jupyter Jupyterlab, Jupyter Notebook.
How do I fix CVE-2024-22421?
Upgrade jupyterlab to a fixed version for your release line: 3.6.7 or 4.0.11.
Is CVE-2024-22421 being exploited?
There is no known exploitation of CVE-2024-22421 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-jupyter-base-notebook-2024-22421, BIT-jupyter-notebook-2024-22421, BIT-jupyterlab-2024-22421, DEBIAN-CVE-2024-22421, GHSA-44cc-43rp-5947, PYSEC-2026-1706 and 1 more.