CVE-2023-25574: JupyterHub's LTI13Authenticator: JWT signature not validated
Impact
Only users that has configured a JupyterHub installation to use the authenticator class LTI13Authenticator are influenced.
LTI13Authenticator that was introduced in jupyterhub-ltiauthenticator 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request granting access to existing and new user identities.
Patches
None.
Workarounds
None.
References
- This code segment didn't validate a JWT signature.
Other sources
jupyterhub-ltiauthenticator is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in jupyterhub-ltiauthenticator 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class LTI13Authenticator are affected. jupyterhub-ltiauthenticator version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-25574?
CVE-2023-25574 is considered a high-severity vulnerability due to improper JWT signature validation.
How do I fix CVE-2023-25574?
To remediate CVE-2023-25574, upgrade the jupyterhub-ltiauthenticator package to version 1.4.0 or higher.
Which JupyterHub installations are affected by CVE-2023-25574?
Only JupyterHub installations configured to use the LTI13Authenticator are impacted by CVE-2023-25574.
What could happen if CVE-2023-25574 is exploited?
Exploitation of CVE-2023-25574 could allow unauthorized access to user sessions due to the lack of JWT signature validation.
When was CVE-2023-25574 disclosed?
CVE-2023-25574 was disclosed as part of the security advisory related to the jupyterhub-ltiauthenticator.