PT-2024-19406 · Unknown · Jupyter-Lsp+3

Bary Levy · Published 2024-01-18 · Updated 2024-01-30 · CVE-2024-22415

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions jupyter-lsp versions prior to 2.2.2

Description The issue affects installations of jupyter-lsp running in environments without configured file system access control and with jupyter-server instances exposed to non-trusted networks, allowing unauthorized access and modification of the file system beyond the jupyter root directory.

Recommendations For versions prior to 2.2.2, upgrade to version 2.2.2 to resolve the issue. As a temporary workaround for users unable to upgrade, consider uninstalling jupyter-lsp. Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp as a mitigation measure.

Exploit

Fix

Improper Access Control

Path traversal

Missing Authentication

Relative Path Traversal

Weakness Enumeration

CWE-284

CWE-22

CWE-306

CWE-23

Related Identifiers

CVE-2024-22415

GHSA-4QHP-652W-C22X

OPENSUSE-SU-2024:13601-1

Affected Products

Jupyter-Lsp

Jupyter Server

Jupyterlab

Jupyterlab-Lsp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22415.json · Exploit
• https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x · Vendor Advisory
• https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22415 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22415 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4qhp-652w-c22x · Vendor Advisory
• https://github.com/jupyter-lsp/jupyterlab-lsp/releases/tag/v5.0.2 · Note
• https://github.com/jupyter-lsp/jupyterlab-lsp · Note
• https://twitter.com/VulmonFeeds/status/1748130892252336422 · Twitter Post
• https://twitter.com/CVEnew/status/1748082314108612649 · Twitter Post