PT-2024-22348 · Unknown+1 · Jupyterhub+1

Th0H0 · Published 2024-03-27 · Updated 2025-09-02 · CVE-2024-28233

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 4.1.0

Description The issue allows an attacker to achieve an XSS directly affecting a user's session by tricking them into visiting a malicious subdomain. This could lead to full access to the JupyterHub API and the user's single-user server. The affected configurations include single-origin JupyterHub deployments and deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. An attacker could create and exfiltrate an API token, exfiltrate files hosted on the user's single-user server, or install malicious extensions.

Recommendations For versions prior to 4.1.0, upgrade to JupyterHub 4.1.0, enable per-user domains via c.JupyterHub.subdomain host, and set c.JupyterHub.cookie host prefix enabled to True to enable domain-locked cookies. Alternatively, deploy JupyterHub on its own domain and enable per-user domains via c.JupyterHub.subdomain host.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-565

CWE-79

CWE-352

Related Identifiers

BIT-JUPYTERHUB-2024-28233

CVE-2024-28233

GHSA-7R3H-4PH8-W38G

Affected Products

Debian

Jupyterhub

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28233.json · Exploit
• https://github.com/jupyterhub/jupyterhub/commit/e2798a088f5ad45340fe79cdf1386198e664f77f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-28233 · Security Note
• https://osv.dev/vulnerability/BIT-jupyterhub-2024-28233 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28233 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28233 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28233 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28233 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28233 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7r3h-4ph8-w38g · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28233 · Vendor Advisory
• https://github.com/jupyterhub/jupyterhub · Note
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-7r3h-4ph8-w38g · Note
• https://t.me/cvenotify/74883 · Telegram Post
• https://twitter.com/CVEnew/status/1773096339544649810 · Twitter Post