id: PYSEC-2024-236
modified: 2025-02-26T23:22:41.524251Z
published: 2024-06-11T22:15:09Z
aliases:
- CVE-2024-35225
- GHSA-fvcq-4x64-hqxr
details: Jupyter Server Proxy allows users to run arbitrary external processes alongside
  their notebook server and provide authenticated web access to them. Versions of
  3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting
  (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`.
  When this endpoint is called with an invalid `host` value, `jupyter-server-proxy`
  replies with a response that includes the value of `host`, without sanitization
  [2]. A third-party actor can leverage this by sending a phishing link with an invalid
  `host` value containing custom JavaScript to a user. When the user clicks this phishing
  link, the browser renders the response of `GET /proxy/<host>`, which runs the custom
  JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can
  be run after the user clicks on a phishing link, this issue permits extensive access
  to the user's JupyterLab instance for an actor. Patches are included in versions
  4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can
  disable the `jupyter-server-proxy` extension.
affected:
- package:
    ecosystem: PyPI
    name: jupyter-server-proxy
    purl: pkg:pypi/jupyter-server-proxy
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 7abc9dc5bbb0b4b440548a5375261b8b8192fc22
    - fixed: ff78128087e73fb9d0909e1366f8bf051e8ea878
    repo: https://github.com/jupyterhub/jupyter-server-proxy
  - type: ECOSYSTEM
    events:
    - introduced: 3.0.0
    - fixed: 3.2.4
    - introduced: 4.1.2
    - fixed: 4.2.0
  versions:
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.1.0
  - 3.2.0
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 4.1.2
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
references:
- type: ADVISORY
  url: 
    https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr
- type: FIX
  url: 
    https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22
- type: FIX
  url: 
    https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
- type: WEB
  url: 
    https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fvcq-4x64-hqxr