cross-site inclusion (XSSI) of files in jupyter-server
Moderate severity
GitHub Reviewed
Published
Aug 28, 2023
in
jupyter-server/jupyter_server
•
Updated Nov 11, 2023
Description
Published by the National Vulnerability Database
Aug 28, 2023
Published to the GitHub Advisory Database
Aug 29, 2023
Reviewed
Aug 29, 2023
Last updated
Nov 11, 2023
Impact
Improper cross-site credential checks on
/files/URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".Patches
Jupyter Server 2.7.2
Workarounds
Use lower performance
--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.References
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
References