CVE-2021-32798
published 2021-08-09CVE-2021-32798: The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter…
PriorityP350critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
2.11%
79.7th percentile
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jupyter-notebook | < jupyter-notebook 6.4.3-1 (bookworm) | jupyter-notebook 6.4.3-1 (bookworm) |
| jupyter | notebook | < 5.7.11 | 5.7.11 |
| jupyter | notebook | — | — |
| jupyter | notebook | — | — |
| jupyter | notebook | >= 0 < 5.7.11 | 5.7.11 |
| jupyter | notebook | >= 5.7.0 < 5.7.11 | 5.7.11 |
| jupyter | notebook | >= 6.0.0 < 6.4.1 | 6.4.1 |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa9.6CRITICAL
osv9.6CRITICAL
vendor_debian10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jupyter server Token bruteforcing
ghsa·2022-06-16·CVSS 9.6
CVE-2022-29241 [CRITICAL] Jupyter server Token bruteforcing
Jupyter server Token bruteforcing
Affects: Notebook and Lab between 6.4.0?(potentially earlier) and 6.4.11 (currently latest). Jupyter Server <=1.16.0. If I am correct about the responsible code it will affect Jupyter-Server 1.17.0 and 2.0.0a0 as well.
Description: If notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this url can be used from an xss payload (as in CVE-2021-32798) or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact wi
OSV
Jupyter server Token bruteforcing
osv·2022-06-16·CVSS 9.6
CVE-2022-29241 [CRITICAL] Jupyter server Token bruteforcing
Jupyter server Token bruteforcing
Affects: Notebook and Lab between 6.4.0?(potentially earlier) and 6.4.11 (currently latest). Jupyter Server <=1.16.0. If I am correct about the responsible code it will affect Jupyter-Server 1.17.0 and 2.0.0a0 as well.
Description: If notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this url can be used from an xss payload (as in CVE-2021-32798) or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact wi
OSV
Special Element Injection in notebook
osv·2021-08-23
CVE-2021-32798 [HIGH] Special Element Injection in notebook
Special Element Injection in notebook
### Impact
Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.
### Patches
5.7.11, 6.4.1
### References
[OWASP Page on Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#injection-prevention-rules)
### For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].
Credit: Guillaume Jeanne from Google
### Example:
A notebook with the following content in a cell and it would display an alert when opened for the first time in Notebook (in an untrusted state):
```
{ "cell_type": "code", "execution_count": 0, "metadata":
GHSA
Special Element Injection in notebook
ghsa·2021-08-23
CVE-2021-32798 [HIGH] CWE-75 Special Element Injection in notebook
Special Element Injection in notebook
### Impact
Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.
### Patches
5.7.11, 6.4.1
### References
[OWASP Page on Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#injection-prevention-rules)
### For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].
Credit: Guillaume Jeanne from Google
### Example:
A notebook with the following content in a cell and it would display an alert when opened for the first time in Notebook (in an untrusted state):
```
{ "cell_type": "code", "execution_count": 0, "metadata":
OSV
CVE-2021-32798: The Jupyter notebook is a web-based notebook environment for interactive computing
osv·2021-08-09·CVSS 9.6
CVE-2021-32798 [CRITICAL] CVE-2021-32798: The Jupyter notebook is a web-based notebook environment for interactive computing
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Debian
CVE-2021-32798: jupyter-notebook - The Jupyter notebook is a web-based notebook environment for interactive computi...
vendor_debian·2021·CVSS 10.0
CVE-2021-32798 [CRITICAL] CVE-2021-32798: jupyter-notebook - The Jupyter notebook is a web-based notebook environment for interactive computi...
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Scope: local
bookworm: resolved (fixed in 6.4.3-1)
bullseye: open
forky: resolved (fixed in 6.4.3-1)
sid: resolved (fixed in 6.4.3-1)
trixie: resolved (fixed in 6.4.3-1)
No detection rules found.
No public exploits indexed.
https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797
2021-08-09
Published