PT-2024-29650 · Unknown+1 · Jupyterhub+1
Oliver-Sanders
·
Published
2024-08-08
·
Updated
2024-08-12
·
CVE-2024-41942
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
JupyterHub versions prior to 4.1.6 and 5.1.0
Description
The issue allows a user granted the
admin:users scope to escalate their own privileges by making themselves a full admin user. This scope is already extremely privileged and only granted to trusted users. In effect, admin:users is equivalent to admin=True, which is not intended. The impact is relatively small, and the change only prevents escalation to the built-in JupyterHub admin role with unrestricted permissions. It does not prevent users with groups permissions from granting themselves or other users permissions via group membership, which is intentional.Recommendations
To resolve the issue, update to version 4.1.6 or 5.1.0, as these versions fix the issue.
As a temporary workaround, consider restricting the use of the
admin:users scope to minimize the risk of exploitation.
Restrict access to the admin=True equivalent permissions to prevent unintended privilege escalation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Jupyterhub