CVE-2024-22415: Unsecured endpoints in the jupyter-lsp server extension
Impact Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory.
Patches Version 2.2.2 has been patched.
Workarounds Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp.
Credits We would like to credit Bary Levy, researcher of pillar.security research team, for the discovery and responsible disclosure of this vulnerability.
Edit: based on advice from pillar.security the Confidentiality/Integrity/Availability were increased to High to reflect potential for critical impact on publicly hosted jupyter-server instances lacking isolation of user privileges on operating system level (for best practices please consult https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#protect-users-from-each-other) and CWE-94 was added due to a potential vulnerability chaining in specific environments.
Other sources
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyter-lspto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
jupyter-lspto a version that resolves this vulnerability.Fixed in 2.2.2Patch Version 2.2.2 has been patched. - Remove
Remove
jupyter-lspfrom your environment.If you do not use jupyterlab-lsp, uninstall jupyter-lsp.
- Remove
Remove
jupyter-lspfrom your environment.If you are unable to upgrade, uninstall jupyter-lsp.
- Compensating control
Ensure jupyter-server instances are not exposed to non-trusted networks and enforce operating system-level filesystem access control so users cannot access/modify files beyond the jupyter root directory.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22415?
CVE-2024-22415 has been classified as a high-severity vulnerability due to the potential for unauthorized access and modification of the file system.
How do I fix CVE-2024-22415?
To fix CVE-2024-22415, upgrade jupyter-lsp to version 2.2.2 or later, and ensure proper file system access control is configured.
What versions of jupyter-lsp are affected by CVE-2024-22415?
CVE-2024-22415 affects jupyter-lsp versions up to and including 2.2.1.
Can CVE-2024-22415 be exploited on all systems running jupyter-lsp?
CVE-2024-22415 can be exploited specifically on systems without configured file system access controls and with exposed jupyter-server instances.
Is there a workaround for CVE-2024-22415 if I can't upgrade jupyter-lsp?
A possible workaround for CVE-2024-22415 includes implementing strict file system access controls to limit unauthorized access while a full update is not feasible.