CVE-2022-24757
📋 TL;DR
CVE-2022-24757 allows unauthorized actors to access sensitive authentication information from Jupyter Server logs when 5xx errors occur. This affects Jupyter Server versions prior to 1.15.4, potentially enabling attackers to steal auth cookies and gain unauthorized access to Jupyter servers.
💻 Affected Systems
- Jupyter Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to Jupyter Server, potentially compromising all hosted notebooks, data, and system resources.
Likely Case
Unauthorized access to Jupyter Server instances leading to data theft, code execution, or privilege escalation within the Jupyter environment.
If Mitigated
Limited impact with proper log access controls and monitoring, though sensitive information may still be exposed in logs.
🎯 Exploit Status
Exploitation requires ability to trigger 5xx errors and access server logs, which may be accessible to various user roles.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.4
Vendor Advisory: https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
Restart Required: Yes
Instructions:
1. Update Jupyter Server using pip: 'pip install --upgrade jupyter-server==1.15.4' 2. Restart all Jupyter Server instances 3. Verify the update with 'jupyter-server --version'
🔧 Temporary Workarounds
Restrict Log File Access
linuxSet strict file permissions on Jupyter Server log files to prevent unauthorized access
chmod 600 /path/to/jupyter/logs/*
chown root:root /path/to/jupyter/logs/*
Disable Detailed Error Logging
allConfigure Jupyter Server to not log sensitive headers in error responses
jupyter server --ServerApp.log_format='%(asctime)s [%(levelname)s] %(message)s'
Set JUPYTER_LOG_FORMAT environment variable
🧯 If You Can't Patch
- Implement strict access controls on Jupyter Server log directories and files
- Monitor log files for unauthorized access attempts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Jupyter Server version with 'jupyter-server --version' or 'pip show jupyter-server' and verify if version is below 1.15.4Check Version:
jupyter-server --versionVerify Fix Applied:
Confirm version is 1.15.4 or higher and test that 5xx errors no longer include sensitive headers in logs📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to log files
- Multiple 5xx errors from same source
- Log entries containing 'Cookie:' or 'Authorization:' headers
Network Indicators:
- Multiple failed authentication attempts triggering 5xx errors
- Unusual access patterns to Jupyter Server logs
SIEM Query:
source="jupyter-server.log" AND ("5xx" OR "500" OR "502" OR "503") AND ("Cookie:" OR "Authorization:" OR "auth_token")🔗 References
- https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
- https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
