CVE-2021-41194
📋 TL;DR
CVE-2021-41194 is an authentication bypass vulnerability in JupyterHub's FirstUseAuthenticator that allows unauthorized access to any user account when user creation is enabled. Attackers can gain access by guessing or knowing usernames. This affects JupyterHub deployments using FirstUseAuthenticator versions before 1.0.0 with create_users=True.
💻 Affected Systems
- JupyterHub FirstUseAuthenticator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, data theft, unauthorized code execution, and potential lateral movement within the JupyterHub environment.
Likely Case
Unauthorized access to user accounts, data exposure, and potential privilege escalation within the JupyterHub platform.
If Mitigated
Limited to existing users with normalized usernames; new user creation disabled reduces attack surface.
🎯 Exploit Status
Exploitation requires only username knowledge/guessing; no authentication needed. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0
Vendor Advisory: https://github.com/jupyterhub/firstuseauthenticator/security/advisories/GHSA-5xvc-vgmp-jgc3
Restart Required: Yes
Instructions:
1. Upgrade firstuseauthenticator package: pip install --upgrade jupyterhub-firstuseauthenticator>=1.0.0
2. Restart JupyterHub service
3. Verify version with: pip show jupyterhub-firstuseauthenticator
🔧 Temporary Workarounds
Disable User Creation
allSet create_users=False to prevent new user creation, limiting vulnerability to existing users with normalized usernames.
c.FirstUseAuthenticator.create_users = False
🧯 If You Can't Patch
- Disable FirstUseAuthenticator entirely and use alternative authentication methods
- Implement network-level controls to restrict access to JupyterHub from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check FirstUseAuthenticator version and configuration: pip show jupyterhub-firstuseauthenticator | grep Version and verify create_users setting in JupyterHub config.Check Version:
pip show jupyterhub-firstuseauthenticator | grep VersionVerify Fix Applied:
Confirm version is 1.0.0 or higher: pip show jupyterhub-firstuseauthenticator | grep Version📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful logins for different usernames
- Unusual user creation events
- Login attempts from unexpected IP addresses
Network Indicators:
- HTTP POST requests to /hub/login with various usernames
- Unusual authentication traffic patterns
SIEM Query:
source="jupyterhub" (event="login" OR event="user_created") | stats count by username, src_ip🔗 References
- https://github.com/jupyterhub/firstuseauthenticator/pull/38
- https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch
- https://github.com/jupyterhub/firstuseauthenticator/security/advisories/GHSA-5xvc-vgmp-jgc3
- https://github.com/jupyterhub/firstuseauthenticator/pull/38
- https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch
- https://github.com/jupyterhub/firstuseauthenticator/security/advisories/GHSA-5xvc-vgmp-jgc3
