Executive brief
Jupyter Server is a web application used for interactive computing and data science. A vulnerability exists where a specially crafted link can trick users into being redirected from their trusted Jupyter environment to a malicious website. This could be used in phishing attacks to steal user credentials or deliver malware by mimicking the appearance of the legitimate server.
Technical details
An open redirect vulnerability (CWE-601) exists in Jupyter Server versions prior to 1.1.1. The issue occurs when the server is configured without a 'base_url' prefix, allowing an attacker to construct a URL that the server will redirect to an arbitrary external domain. Exploitation requires a user to click a maliciously crafted link. This can facilitate phishing or social engineering attacks by leveraging the trust of the Jupyter Server's domain. The vulnerability was addressed in version 1.1.1; a workaround involves setting a non-root base URL using the '--ServerApp.base_url' configuration.
Affected products
- Jupyter jupyter-server < 1.1.1
Timeline
- 2020-12-16: disclosed
- 2020-12-16: patched: Patched in version 1.1.1
- 2020-12-21: advisory