Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-35225
Summary
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. The '/proxy' endpoint accepts a 'host' path segment in the format '/proxy/<host>'. When this endpoint is called with an invalid 'host' value, 'jupyter-server-proxy' replies with a response that includes the value of 'host', without sanitization. A third-party actor can leverage this by sending a phishing link with an invalid 'host' value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of 'GET /proxy/<host>', which runs the custom JavaScript contained in 'host' set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue affects the package jupyter-server-proxy versions 3.0.0rc1 through 3.2.3, and 4.0.0 through 4.1.2 are vulnerable to Reflected Cross-Site Scripting (XSS).
- LOW
- NETWORK
- LOW
- CHANGED
- REQUIRED
- NONE
- LOW
- NONE
CWE-79 - Cross Site Scripting
Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.
References
Advisory Timeline
- Published
