Homepage
About Snyk

Missing Authentication for Critical Function Affecting jupyter-server-proxy package, versions [,3.2.3) [4.0.0,4.1.1)

0.0
critical

Snyk CVSS

    Attack Complexity High
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-JUPYTERSERVERPROXY-6474572
  • published 21 Mar 2024
  • disclosed 20 Mar 2024
  • credit Yuvi Panda
Report a new vulnerability Found a mistake?

Introduced: 20 Mar 2024

CVE-2024-28179 Open this link in a new tab
CWE-306 Open this link in a new tab

How to fix?

Upgrade jupyter-server-proxy to version 3.2.3, 4.1.1 or higher.

Overview

jupyter-server-proxy is a Jupyter server extension to supervise and proxy web services

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to improper authentication checks when proxying websockets. This vulnerability allows unauthenticated remote access to any websocket endpoint configured to be accessible via the package. In many instances, this could lead to remote unauthenticated arbitrary code execution, depending on how the affected instances utilize websockets.

Note:

The websocket endpoints exposed by jupyter_server itself are not impacted, and projects that do not utilize websockets remain unaffected.