Is CVE-2024-29033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-29033 being exploited in the wild.

How severe is CVE-2024-29033?

High severity, with a CVSS score of 7.5, published 20 March 2024.

Which products and versions are affected?

oauthenticator (PyPI) < 16.3.0, ECOSYSTEM:introduced=0,fixed=16.3.0.

Is there a fix for CVE-2024-29033?

Yes. oauthenticator (PyPI): upgrade to 16.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-29033 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-29033?

Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29033: JupyterHub GoogleOAuthenticator improper authorization in hosted_domain check

Q: Is there a fix for CVE-2024-29033?

Yes. oauthenticator (PyPI): upgrade to 16.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-29033 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-29033?

Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29033 · Severity: high · CVSS 7.5 · Published 2024-03-20

A vulnerability in the Google authentication library for JupyterHub allows unauthorized users to bypass domain restrictions. The system incorrectly verifies organization membership by only checking if an email address ends with a specific domain, rather than confirming the account is part of a verified Google Workspace. This could allow an attacker who has previously accessed a domain-linked email to gain unauthorized access to private JupyterHub environments.

Technologies: oauthenticator (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-29033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-29033 being exploited in the wild.
How severe is CVE-2024-29033?: High severity, with a CVSS score of 7.5, published 20 March 2024.
Which products and versions are affected?: oauthenticator (PyPI) < 16.3.0, ECOSYSTEM:introduced=0,fixed=16.3.0.
Is there a fix for CVE-2024-29033?: Yes. oauthenticator (PyPI): upgrade to 16.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-29033 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-29033?: Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

oauthenticator (PyPI): upgrade to 16.3.0 or later
```
pip install "oauthenticator>=16.3.0"
```

Technical details

The GoogleOAuthenticator.hosted_domain configuration in the oauthenticator library (versions prior to 16.3.0) fails to properly validate that a Google account belongs to a specific Google organization or workspace. Instead of verifying the account's organizational membership via OAuth2 metadata, it performs a simple suffix check on the user's email address. An attacker who has created a Google account with a matching domain suffix (which is possible under certain conditions if they previously had access to the domain's email) can bypass authorization checks. This is an improper authorization vulnerability (CWE-285) exploitable over the network without prior privileges. The issue is resolved in version 16.3.0.

Affected products

JupyterHub oauthenticator < 16.3.0

Identifiers

CVE-2024-29033
GHSA-55m3-44xf-hg4h
PYSEC-2026-1710

Timeline

2023-12-15: disclosed: Underlying Google OAuth behavior described in blog post
2024-03-20: advisory: GitHub Advisory published
2024-03-20: patched: Version 16.3.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.