CVE-2019-9644

Vulnerability

Jupyter Notebook versions before 5.7.6 contain a cross-site inclusion (XSSI) vulnerability. The bug allows a malicious page to include resources from a Jupyter server when the victim is authenticated to that server. This is possible because Internet Explorer's error messages can include the content of any invalid JavaScript encountered, enabling an attacker to capture the content of included resources. The vulnerability affects all Jupyter Notebook versions prior to 5.7.6. [1][2]

Exploitation

An attacker must host a malicious web page that includes a resource from a Jupyter server (e.g., via a script tag). The victim must be authenticated to that Jupyter server and visit the malicious page using Internet Explorer. The attacker then captures the content of the resource through Internet Explorer's error messages, which reveal the content of invalid JavaScript. The attack does not require any additional user interaction beyond visiting the page. [2]

Impact

Successful exploitation allows an attacker to read the content of resources hosted on the Jupyter server that the victim has access to. This can lead to disclosure of sensitive information, such as notebook contents, configuration files, or other data accessible via the Jupyter server. The attack is limited to Internet Explorer and requires the victim to be authenticated. [2]

Mitigation

The vulnerability is fixed in Jupyter Notebook version 5.7.6, released on March 8, 2019. Users should upgrade to 5.7.6 or later. For users unable to upgrade, a workaround is to avoid using Internet Explorer to access Jupyter servers while authenticated. The fix is available in commit 05aa4b2. [1][4]