CVE-2022-21697

published 2022-01-25

CVE-2022-21697: Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to…

Priority P3 41 high 7.1 CVSS 3.1

AV N AC L PR L UI N S U C H I L A N

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
jupyter	jupyter_server_proxy	< 3.2.1	3.2.1
jupyterhub	jupyter-server-proxy	< 3.2.1	3.2.1
jupyterhub	jupyter-server-proxy	>= 0 < 3.2.1	3.2.1
jupyterhub	jupyter-server-proxy	>= 0 < fd31930bacd12188c448c886e0783529436b99eb	fd31930bacd12188c448c886e0783529436b99eb

CVSS provenance

nvd v3.1 7.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918