Executive brief
A vulnerability in the Google authentication library for JupyterHub allows unauthorized users to bypass domain restrictions. The system incorrectly verifies organization membership by only checking if an email address ends with a specific domain, rather than confirming the account is part of a verified Google Workspace. This could allow an attacker who has previously accessed a domain-linked email to gain unauthorized access to private JupyterHub environments.
Technical details
The GoogleOAuthenticator.hosted_domain configuration in the oauthenticator library (versions prior to 16.3.0) fails to properly validate that a Google account belongs to a specific Google organization or workspace. Instead of verifying the account's organizational membership via OAuth2 metadata, it performs a simple suffix check on the user's email address. An attacker who has created a Google account with a matching domain suffix (which is possible under certain conditions if they previously had access to the domain's email) can bypass authorization checks. This is an improper authorization vulnerability (CWE-285) exploitable over the network without prior privileges. The issue is resolved in version 16.3.0.
Affected products
- JupyterHub oauthenticator < 16.3.0
Timeline
- 2023-12-15: disclosed: Underlying Google OAuth behavior described in blog post
- 2024-03-20: advisory: GitHub Advisory published
- 2024-03-20: patched: Version 16.3.0 released