CVE-2024-28179 json
Jupyter Server Proxy's Websocket Proxying does not require authentication
published 2024-03-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-1020 , GHSA-w3vc-fx9p-wp4v , PYSEC-2024-234
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.
Patch / fix
- pypi jupyter-server-proxy 3.2.3, 4.1.1
- jupyter jupyter_server_proxy 3.2.3, 4.1.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | jupyter-server-proxy | >=4.0.0, <4.1.1 <3.2.3 |
4.1.1 3.2.3 |
Affected products
- jupyterhub jupyter-server-proxy
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9
web, patch
-
github.com
/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03
web, patch
-
github.com
/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v
web, vendor-advisory, advisory
-
github.com
/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.p
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-28179
advisory
-
github.com
/jupyterhub/jupyter-server-proxy
package
-
github.com
/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-234.yaml
web
-
github.com
/advisories/GHSA-w3vc-fx9p-wp4v
advisory
Sources
- CVE List CVE-2024-28179
- GitHub Advisory GHSA-w3vc-fx9p-wp4v
- NVD CVE-2024-28179
- OSV PYSEC-2024-234
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.