CVE-2024-28233: XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
Impact
Affected configurations:
- Single-origin JupyterHub deployments - JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server.
By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve the following:
- Full access to JupyterHub API and user's single-user server, e.g. - Create and exfiltrate an API Token - Exfiltrate all files hosted on the user's single-user server: notebooks, images, etc. - Install malicious extensions. They can be used as a backdoor to silently regain access to victim's session anytime.
Patches
To prevent cookie-tossing:
- Upgrade to JupyterHub 4.1 (both hub and user environment) - enable per-user domains via c.JupyterHub.subdomainhost = "https://mydomain.example.org" - set c.JupyterHub.cookiehostprefixenabled = True to enable domain-locked cookies
or, if available (applies to earlier JupyterHub versions):
- deploy jupyterhub on its own domain, not shared with any other services - enable per-user domains via c.JupyterHub.subdomainhost = "https://mydomain.example.org"
Other sources
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28233?
CVE-2024-28233 is classified as a high severity vulnerability due to its potential impact on single-origin JupyterHub deployments.
How do I fix CVE-2024-28233?
To remediate CVE-2024-28233, upgrade JupyterHub to version 4.1.0 or later using pip.
What systems are affected by CVE-2024-28233?
CVE-2024-28233 affects single-origin JupyterHub deployments and those with user-controlled applications on subdomains.
What is the exploit mechanism for CVE-2024-28233?
CVE-2024-28233 can be exploited by tricking users into visiting a malicious subdomain.
Is CVE-2024-28233 patched in previous versions of JupyterHub?
No, CVE-2024-28233 is not patched in versions prior to 4.1.0, requiring an upgrade to fix the vulnerability.