CVE-2023-40170: cross-site inclusion (XSSI) of files in jupyter-server
Impact
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance --ContentsManager.fileshandlerclass=jupyterserver.files.handlers.FilesHandler, which implements the correct checks.
References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
Other sources
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.fileshandlerclass=jupyterserver.files.handlers.FilesHandler, which implements the correct checks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40170?
The severity of CVE-2023-40170 is medium with a CVSS score of 6.1.
How can CVE-2023-40170 impact my system?
CVE-2023-40170 could allow exposure of certain file contents or unauthorized access to files when opening untrusted files via "Open image in new tab".
Which software versions are affected by CVE-2023-40170?
Versions up to and excluding 2.7.2 of Jupyter Server and Jupyter Jupyter Server are affected by CVE-2023-40170.
How can I fix CVE-2023-40170?
To fix CVE-2023-40170, update Jupyter Server to version 2.7.2 or apply the available patch.
Are there any workarounds for CVE-2023-40170?
A workaround for CVE-2023-40170 is to use the lower performance `--ContentsManager.files_handler` option.