Headline
GHSA-4qhp-652w-c22x: Unsecured endpoints in the jupyter-lsp server extension
Impact
Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. Please note this vulnerability is in the extension and is patched in version 2.2.2 of that extension. This extension has been updated in jupyterlab-lsp version 5.0.2.
Patches
Version 2.2.2 has been patched.
Workarounds
Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp.
Credits
We would like to credit Bary Levy, researcher of pillar.security research team, for the discovery and responsible disclosure of this vulnerability.
Impact
Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. Please note this vulnerability is in the extension and is patched in version 2.2.2 of that extension. This extension has been updated in jupyterlab-lsp version 5.0.2.
Patches
Version 2.2.2 has been patched.
Workarounds
Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp.
Credits
We would like to credit Bary Levy, researcher of pillar.security research team, for the discovery and responsible disclosure of this vulnerability.
References
- GHSA-4qhp-652w-c22x
- https://github.com/jupyter-lsp/jupyterlab-lsp/releases/tag/v5.0.2