Missing Authentication for Critical Function Affecting jupyter-server-proxy package, versions [,3.2.3) [4.0.0,4.1.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JUPYTERSERVERPROXY-6474572
- published 21 Mar 2024
- disclosed 20 Mar 2024
- credit Yuvi Panda
Introduced: 20 Mar 2024
CVE-2024-28179 Open this link in a new tabHow to fix?
Upgrade jupyter-server-proxy to version 3.2.3, 4.1.1 or higher.
Overview
jupyter-server-proxy is a Jupyter server extension to supervise and proxy web services
Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to improper authentication checks when proxying websockets. This vulnerability allows unauthenticated remote access to any websocket endpoint configured to be accessible via the package. In many instances, this could lead to remote unauthenticated arbitrary code execution, depending on how the affected instances utilize websockets.
Note:
The websocket endpoints exposed by jupyter_server itself are not impacted, and projects that do not utilize websockets remain unaffected.