CVE-2022-21697: SSRF vulnerability (requires authentication)
Impact
What kind of vulnerability is it? Server-Side Request Forgery ( SSRF )
Who is impacted? Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled.
A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the allowedhosts check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.
Patches
Has the problem been patched? What versions should users upgrade to?
Upgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch
For more information
If you have any questions or comments about this advisory:
Open a topic on our forum Email the Jupyter security team at security@ipython.org
Other sources
Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the allowedhosts check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-21697?
CVE-2022-21697 is a vulnerability in Jupyter Server Proxy, a Jupyter notebook server extension, that allows for Server-Side Request Forgery (SSRF).
How does CVE-2022-21697 affect Jupyter Server Proxy?
CVE-2022-21697 affects Jupyter Server Proxy version up to 3.2.1.
What is Server-Side Request Forgery (SSRF)?
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server, potentially leading to unauthorized access or data exfiltration from internal systems.
What is the severity of CVE-2022-21697?
The severity of CVE-2022-21697 is high, with a CVSS score of 7.1.
How can I fix CVE-2022-21697 in Jupyter Server Proxy?
To fix CVE-2022-21697, update Jupyter Server Proxy to version 3.2.1 or higher.