JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
Description
Summary
JupyterHub's XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, which they are not, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server.
Patches
Upgrade to JupyterHub 5.4.5.
Mitigations
If a reverse proxy is in use, drop requests to JupyterHub with Sec-Fetch-Mode: no-cors.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jupyterhubPyPI | >= 4.1.0, < 5.4.5 | 5.4.5 |
Affected products
1- Range: >= 4.1.0, < 5.4.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.