CVE-2024-28179

Advisory

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. A vulnerability existed where Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone with network access to the Jupyter server endpoint. This vulnerability permits unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy, potentially leading to remote unauthenticated arbitrary code execution due to the use of websockets in affected instances. Projects that do not rely on websockets are not affected. The websocket endpoints exposed by jupyter_server itself are also not affected. This issue has been fixed in the latest versions.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-w3vc-fx9p-wp4v
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28179