PT-2022-16859 · Unknown+1 · Jupyter Server+1

3Coins · Published 2022-03-23 · Updated 2022-04-04 · CVE-2022-24757

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 1.15.4

Description The Jupyter Server is vulnerable to unauthorized access of sensitive information from server logs. When a 5xx error occurs, the auth cookie and other header values are recorded in the logs by default. Since these logs do not require root access, an attacker can monitor them, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Recommendations Upgrade to Jupyter Server version 1.15.4 to resolve the issue. As a temporary workaround, consider restricting access to the server logs to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-24757

GHSA-P737-P57G-4CPR

PYSEC-2022-179

Affected Products

Debian

Jupyter Server

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24757.json · Exploit
• https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24757 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24757 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24757 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24757 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24757 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24757 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-179 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p737-p57g-4cpr · Vendor Advisory
• https://github.com/jupyter-server/jupyter_server · Note
• https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2022-179.yaml · Note
• https://t.me/cibsecurity/39441 · Telegram Post