CVE-2023-40170: jupyter-server jupyter_server Improper Access Control

Vulnerability summary

CVE-2023-40170 is a medium (CVSS 6.1) Improper Access Control vulnerability in jupyter-server jupyter_server. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.9% of scored vulnerabilities.

Timeline

1. 28-08-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.