GitHub Advisoryadvisory · PyPI

GHSA-64x5-55rw-9974 cross-site inclusion (XSSI) of files in jupyter-server

MEDIUM Published 2023-08-29 Modified 2023-08-29 Official page ↗
Aliases
CVE-2023-40170
Ecosystem
PyPI
Packages
jupyter-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-284, CWE-306, CWE-79
Reviewed
2023-08-29

Affected packages

• PyPI jupyter-server: < 2.7.2 → fixed in 2.7.2

Description

Impact Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". Patches Jupyter Server 2.7.2 Workarounds Use lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks. References Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open. Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Related

Alias · CVE (1)

  • CVE-2023-40170 jupyter-server is the backend for Jupyter web applications. vulnerability

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References