# CVE-2024-28179: Jupyter Server Proxy's Websocket Proxying does not require authentication

Source: https://junglewise.ai/threats/cve-2024-28179-jupyter-server-proxy-s-websocket-proxying-does-not-require  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-20  
License: CC BY 4.0 with a link back

CVE-2024-28179 · Severity: low · CVSS 3.1 · Published 2024-03-20

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.

Technologies: [jupyter-server-proxy (PyPI)](https://junglewise.ai/threats/technologies/jupyter-server-proxy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-28179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-28179 being exploited in the wild.

**How severe is CVE-2024-28179?** Low severity, with a CVSS score of 3.1, published 20 March 2024.

**Which products and versions are affected?** jupyter-server-proxy (PyPI) ECOSYSTEM:introduced=4.0.0,fixed=4.1.1, GIT:introduced=0,fixed=764e499f61a87641916a7a427d4c4b1ac3f321a9,fixed=bead903b7c0354b6efd8b4cde94b89afab653e03|ECOSYSTEM:introduced=0,fixed=3.2.3,introduced=4.0.0,fixed=4.1.1.

**Is there a fix for CVE-2024-28179?** Yes. jupyter-server-proxy (PyPI): upgrade to 4.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-28179?** Check whether you run jupyter-server-proxy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jupyter-server-proxy (PyPI): upgrade to 4.1.1 or later

  ```sh
  pip install "jupyter-server-proxy>=4.1.1"
  ```


## Affected products

- jupyter-server-proxy (PyPI) ECOSYSTEM:introduced=4.0.0,fixed=4.1.1, GIT:introduced=0,fixed=764e499f61a87641916a7a427d4c4b1ac3f321a9,fixed=bead903b7c0354b6efd8b4cde94b89afab653e03|ECOSYSTEM:introduced=0,fixed=3.2.3,introduced=4.0.0,fixed=4.1.1

## Identifiers

- CVE-2024-28179
- GHSA-w3vc-fx9p-wp4v
- PYSEC-2024-234

## Related threats

- [Jupyter Server Proxy has a reflected XSS issue in host parameter](https://junglewise.ai/threats/cve-2024-35225-jupyter-server-proxy-has-a-reflected-xss-issue-in-host-parameter)
- [SSRF vulnerability in jupyter-server-proxy](https://junglewise.ai/threats/cve-2022-21697-ssrf-vulnerability-in-jupyter-server-proxy)