CVE-2023-40170

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

Jupyter Server, the backend for Jupyter web applications, prior to version 2.21.0 copies the Referer header into a JSON header block in the 5xx request logging path without applying the token scrubbing used for the request URI. A request returning HTTP 500 whose Referer contains a token-bearing URL can write that token to server logs in plaintext.

Jupyter Server prior to version 2.20 has a stored XSS vulnerability in nbconvert handlers. A notebook with an HTML payload in display_data output can lead to cookie theft, full API access, and kernel RCE.

In jupyter-server versions 1.12.0 through 2.17.0, a vulnerability allows bypassing CORS origin validation when using `allow_origin_pat`. The issue is due to `re.match()` only anchoring at the start, allowing attacker-controlled domains like `trusted.example.com.evil.com` to pass validation for patterns intended for `trusted.example.com`. This affects CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing, arbitrary code execution, and unauthorized access to sensitive API responses.

A path traversal vulnerability in jupyter-server 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function. This allows unauthorized read/write access to files in sibling directories.

Jupyter Server up to version 2.17.0 persists the secret used to sign authentication cookies to a static file and does not rotate it after a password change. After a password reset and server restart, previously issued cookies remain valid, allowing an attacker who captured a session cookie to retain access despite the password change.

Jupyter Server versions 2.17.0 and earlier use re.match() for Origin header validation, allowing bypass of CORS restrictions. An attacker controlling a domain like trusted.example.com.evil.com can make cross-origin requests to the server API.

Jupyter Server versions 2.17.0 and earlier contain a path traversal vulnerability in the REST API that allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments with predictable naming schemes are particularly at risk. Version 2.18.0 contains a fix.

Jupyter Server versions through 2.17.0 have insufficient validation of the next query parameter in the login flow within LoginFormHandler._redirect_safe(), allowing redirects to arbitrary external domains. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks.

The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.