PT-2021-11960 · Unknown · Jupyterhub

Jhespeter · Published 2021-01-13 · Updated 2024-03-06 · CVE-2020-36191

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: JupyterHub version 1.1.0

Description: The issue allows for CSRF in the admin panel via a request that lacks an xsrf field. This can be demonstrated by a "/hub/api/user" request, which can be used to add or remove a user account.

Recommendations: For JupyterHub version 1.1.0, consider disabling the /hub/api/user endpoint until a patch is available to prevent exploitation. As a temporary workaround, ensure that all requests to the admin panel include a valid xsrf field to mitigate the risk of CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-JUPYTERHUB-2020-36191

CVE-2020-36191

GHSA-7XX3-QP5W-FW96

PYSEC-2021-67

Affected Products

Jupyterhub

References · 17

• 🔥 https://github.com/jupyterhub/jupyterhub/issues/3304 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-36191 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36191 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36191 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-67 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7xx3-qp5w-fw96 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36191 · Security Note
• https://ubuntu.com/security/CVE-2020-36191 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterhub-2020-36191 · Vendor Advisory
• https://github.com/jupyterhub/jupyterhub · Note
• https://github.com/jupyterhub/jupyterhub/releases · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-67.yaml · Note
• https://github.com/advisories/GHSA-7xx3-qp5w-fw96 · Note