CVE-2022-21697: SSRF vulnerability in jupyter-server-proxy

CVE-2022-21697 · Severity: low · CVSS 3.1 · Published 2022-01-25

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.

Technologies: jupyter-server-proxy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-21697 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-21697 being exploited in the wild.
How severe is CVE-2022-21697?
Low severity, with a CVSS score of 3.1, published 25 January 2022.
Which products and versions are affected?
jupyter-server-proxy (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.1, GIT:introduced=0,fixed=fd31930bacd12188c448c886e0783529436b99eb|ECOSYSTEM:introduced=0,fixed=3.2.1.
Is there a fix for CVE-2022-21697?
Yes. jupyter-server-proxy (PyPI): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2022-21697?
Check whether you run jupyter-server-proxy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jupyter-server-proxy (PyPI): upgrade to 3.2.1 or later
    pip install "jupyter-server-proxy>=3.2.1"

Affected products

  • jupyter-server-proxy (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.1, GIT:introduced=0,fixed=fd31930bacd12188c448c886e0783529436b99eb|ECOSYSTEM:introduced=0,fixed=3.2.1

Identifiers

  • CVE-2022-21697
  • GHSA-gcv9-6737-pjqw
  • PYSEC-2022-16

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.