Is CVE-2020-26275 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-26275 being exploited in the wild.

How severe is CVE-2020-26275?

Medium severity, with a CVSS score of 6.1, published 21 December 2020.

Which products and versions are affected?

jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1, GIT:introduced=0,fixed=85e4abccf6ea9321d29153f73b0bd72ccb3a6bca|ECOSYSTEM:introduced=0,fixed=1.1.1.

Is there a fix for CVE-2020-26275?

Yes. jupyter-server (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-26275 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-26275?

Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-26275: Jupyter Server open redirect vulnerability

CVE-2020-26275 · Severity: medium · CVSS 6.1 · Published 2020-12-21

Jupyter Server is a web application used for interactive computing and data science. A vulnerability exists where a specially crafted link can trick users into being redirected from their trusted Jupyter environment to a malicious website. This could be used in phishing attacks to steal user credentials or deliver malware by mimicking the appearance of the legitimate server.

Technologies: jupyter-server (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2020-26275 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-26275 being exploited in the wild.
How severe is CVE-2020-26275?: Medium severity, with a CVSS score of 6.1, published 21 December 2020.
Which products and versions are affected?: jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1, GIT:introduced=0,fixed=85e4abccf6ea9321d29153f73b0bd72ccb3a6bca|ECOSYSTEM:introduced=0,fixed=1.1.1.
Is there a fix for CVE-2020-26275?: Yes. jupyter-server (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-26275 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-26275?: Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jupyter-server (PyPI): upgrade to 1.1.1 or later
```
pip install "jupyter-server>=1.1.1"
```

Technical details

An open redirect vulnerability (CWE-601) exists in Jupyter Server versions prior to 1.1.1. The issue occurs when the server is configured without a 'base_url' prefix, allowing an attacker to construct a URL that the server will redirect to an arbitrary external domain. Exploitation requires a user to click a maliciously crafted link. This can facilitate phishing or social engineering attacks by leveraging the trust of the Jupyter Server's domain. The vulnerability was addressed in version 1.1.1; a workaround involves setting a non-root base URL using the '--ServerApp.base_url' configuration.

Affected products

Jupyter jupyter-server < 1.1.1

Identifiers

CVE-2020-26275
GHSA-9f66-54xg-pc2c
PYSEC-2020-346
PYSEC-2020-50

Timeline

2020-12-16: disclosed
2020-12-16: patched: Patched in version 1.1.1
2020-12-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.