An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5585-1 advisory.

    It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly     use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS)     attacks on the notebook server. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19351)

    It was discovered that Jupyter Notebook incorrectly handled certain SVG documents. An attacker could     possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu     18.04 LTS. (CVE-2018-21030)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs on the login page. An attacker     could possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-10255)

    It was discovered that Jupyter Notebook had an incomplete fix for CVE-2019-10255. An attacker could     possibly use this issue to perform open-redirect attack using empty netloc. (CVE-2019-10856)

    It was discovered that Jupyter Notebook incorrectly handled the inclusion of remote pages on Jupyter     server. An attacker could possibly use this issue to perform cross-site script inclusion (XSSI) attacks.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2019-9644)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a notebook. An attacker could     possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-26215)

    It was discovered that Jupyter Notebook server access logs were not protected. An attacker having access     to the notebook server could possibly use this issue to get access to steal sensitive information such as     auth/cookies. (CVE-2022-24758)

    It was discovered that Jupyter Notebook incorrectly configured hidden files on the server. An     authenticated attacker could possibly use this issue to see unwanted sensitive hidden files from the     server which may result in getting full access to the server. This issue only affected Ubuntu 20.04 LTS     and Ubuntu 22.04 LTS. (CVE-2022-29238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-10255, CVE-2019-9644.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jupyter blog :

Login pages tend to take a parameter for redirecting back to a page after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so that you aren't disrupted too much if you try to visit a page, but have to authenticate first. An Open Redirect Vulnerability is when a malicious person crafts a link pointing to the login page of a trusted site, but setting the 'redirect after successful login' parameter to send the user to their own site, instead of a page on the authenticated site (the notebook or JupyterHub server), e.g.
/login?next=http://badwebsite.biz. This doesn't necessarily compromise anything immediately, but it enables phishing if users don't notice that the domain has changed, e.g. by showing a fake 're-enter your password' page. Servers generally have to validate the redirect URL to avoid this. Both JupyterHub and Notebook already do this, but the validation didn't take into account all possible ways to redirect to other sites, so some malicious URLs could still be crafted to redirect away from the server (the above example does not work in any recent version of either package). Only certain browsers (Chrome and Firefox, not Safari) could be redirected from the JupyterHub login page, but all browsers could be redirected away from a standalone notebook server.

ID	Name	Product	Family	Severity
164506	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Jupyter Notebook vulnerabilities (USN-5585-1)	Nessus	Ubuntu Local Security Checks	high
124526	Fedora 30 : python-notebook (2019-a6e1287e76)	Nessus	Fedora Local Security Checks	medium
124010	Fedora 29 : python-notebook (2019-9e67979b2a)	Nessus	Fedora Local Security Checks	medium
123540	FreeBSD : Jupyter notebook -- open redirect vulnerability (fe7e322f-522d-11e9-98b5-216e512dad89)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-10255

medium

Tenable Plugins

high

medium

medium

medium