Headline
GHSA-64x5-55rw-9974: cross-site inclusion (XSSI) of files in jupyter-server
Impact
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
Package
pip jupyter-server (pip)
Affected versions
< 2.7.2
Patched versions
2.7.2
Description
Impact
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
References
- GHSA-64x5-55rw-9974
- https://nvd.nist.gov/vuln/detail/CVE-2023-40170
- jupyter-server/jupyter_server@87a4927
Zsailer published to jupyter-server/jupyter_server
Aug 28, 2023
Published to the GitHub Advisory Database
Aug 29, 2023
Reviewed
Aug 29, 2023
Last updated
Aug 29, 2023
Related news
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.