PT-2022-15049 · Unknown · Jupyter Server Proxy

Mr-R3Bot · Published 2022-01-25 · Updated 2022-02-01 · CVE-2022-21697

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Server Proxy versions prior to 3.2.1

Description The issue is related to Server-Side Request Forgery (SSRF) due to a lack of input validation, allowing authenticated clients to proxy requests to other hosts and bypass the allowed hosts check. This is considered low to moderate severity because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution. Any user deploying Jupyter Server or Notebook with the jupyter-proxy-server extension enabled is affected.

Recommendations For versions prior to 3.2.1, upgrade to version 3.2.1 to receive a patch. As a temporary workaround, users can also install the patch manually.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-21697

GHSA-GCV9-6737-PJQW

PYSEC-2022-16

Affected Products

Jupyter Server Proxy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21697.json · Exploit
• https://github.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e0783529436b99eb · Patch
• https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21697 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcv9-6737-pjqw · Vendor Advisory
• https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw · Note
• https://github.com/jupyterhub/jupyter-server-proxy · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2022-16.yaml · Note
• https://t.me/cibsecurity/36218 · Telegram Post