CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication
Unauthenticated attackers can access websocket endpoints in Jupyter Server Proxy, potentially leading to remote arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28179?
CVE-2024-28179 is a critical missing authorization vulnerability in jupyterhub jupyter-server-proxy, published on 20 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.
Weakness: CWE-306
Which versions are affected by CVE-2024-28179?
5 open source packages ship an affected version, including jupyter-server-proxy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyter-server-proxy PyPI | All versions | 3.2.3, 4.1.1 |
jupyter-server-proxy PyPI | All versions | 3.2.3 |
jupyter-server-proxy PyPI | All versions | 3.2.3 |
jupyter-server-proxy PyPI | From 4.0.0 | 4.1.1 |
jupyter-server-proxy PyPI | From 4.0.0 | 4.1.1 |
Products include Jupyter Jupyter Server Proxy.
How do I fix CVE-2024-28179?
Upgrade jupyter-server-proxy to a fixed version for your release line: 3.2.3 or 4.1.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-28179 being exploited?
There is no known exploitation of CVE-2024-28179 in the wild and no public exploit code.
Other vulnerabilities in jupyterhub jupyter-server-proxy
Sources
Also known as GHSA-w3vc-fx9p-wp4v, PYSEC-2024-234.