CVE-2024-22421: Potential authentication and CSRF tokens leak in JupyterLab
Impact Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.
Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.
Workarounds No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.
References
Vulnerability reported by user @davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
Other sources
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/notebookto a version that resolves this vulnerability.Fixed in 7.0.7 - Upgrade
Upgrade
pip/jupyterlabto a version that resolves this vulnerability.Fixed in 3.6.7 - Upgrade
Upgrade
pip/jupyterlabto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
JupyterLabto a version that resolves this vulnerability.Fixed in 4.1.0b2 - Upgrade
Upgrade
JupyterLabto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
JupyterLabto a version that resolves this vulnerability.Fixed in 3.6.7 - Upgrade
Upgrade
jupyter-serverto a version that resolves this vulnerability.Fixed in 2.7.2 - Compensating control
Ensure users do not click malicious links when running JupyterLab with older jupyter-server versions, as token exposure (Authorization and XSRFToken) can occur via a malicious link.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22421?
CVE-2024-22421 is considered a high severity vulnerability due to the potential exposure of users' sensitive tokens.
How do I fix CVE-2024-22421?
To fix CVE-2024-22421, upgrade to JupyterLab versions 4.1.0b2, 4.0.11, or 3.6.7.
Who is affected by CVE-2024-22421?
Users of JupyterLab using affected older versions of the jupyter-server are at risk for CVE-2024-22421.
What does CVE-2024-22421 exploit?
CVE-2024-22421 exploits vulnerabilities in older versions of JupyterLab when users click on malicious links.
Is there a workaround for CVE-2024-22421?
There are no effective workarounds for CVE-2024-22421, and updating is the recommended action.