CVE-2022-24758: Jupyter Notebook Information Disclosure

CVE-2022-24758 Overview

CVE-2022-24758 is a sensitive information exposure vulnerability affecting Jupyter Notebook, the popular web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Critical Impact

Attackers with access to Jupyter server logs can steal authentication cookies and session tokens, potentially gaining unauthorized access to the Jupyter environment and any data or code it contains.

Affected Products

• Jupyter Notebook versions prior to 6.4.9

Discovery Timeline

• 2022-03-31 - CVE CVE-2022-24758 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24758

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). The core issue lies in Jupyter Notebook's default logging behavior, which inadvertently captures sensitive authentication data when server errors occur. When the Jupyter server encounters a 5xx error condition, the default logging configuration records HTTP header values including authentication cookies in the server log files.

The security impact is significant because Jupyter server logs are typically readable by non-root users on the system. This creates an attack surface where a local attacker with limited privileges can passively monitor log files to harvest authentication credentials. Once obtained, these credentials can be used to impersonate legitimate users and gain full access to the Jupyter notebook environment.

Root Cause

The root cause of this vulnerability is improper logging hygiene in the Jupyter Notebook server. The default logging configuration fails to sanitize or redact sensitive HTTP header values before writing them to log files. Specifically, when a 5xx internal server error is generated, the error handling routine logs the full request context including authentication headers and cookies without filtering sensitive data.

Attack Vector

The attack vector is network-based and can be exploited without authentication. An attacker would need local access to the system running the Jupyter server to read the log files. The exploitation flow involves:

1. Gaining local access to the system hosting the Jupyter Notebook server
2. Monitoring or reading Jupyter server log files (which don't require root permissions)
3. Waiting for or triggering 5xx errors to cause sensitive headers to be logged
4. Extracting authentication cookies and session tokens from the logs
5. Using the stolen credentials to access the Jupyter server as an authenticated user

The vulnerability does not require any user interaction to exploit, and the attacker needs no prior authentication to the Jupyter service itself—only read access to the log files on the local system.

Detection Methods for CVE-2022-24758

Indicators of Compromise

• Unusual access patterns to Jupyter server log files by non-administrative users
• Multiple authentication sessions from different IP addresses using the same session token
• Unexpected file system access events targeting /var/log/jupyter/ or application-specific log directories

Detection Strategies

• Monitor file access events on Jupyter server log files using auditd or similar file integrity monitoring tools
• Implement log analysis to detect multiple concurrent sessions using identical authentication tokens from disparate network locations
• Review authentication logs for session reuse anomalies that may indicate credential theft

Monitoring Recommendations

• Configure SIEM rules to alert on suspicious log file access patterns
• Enable enhanced auditing on directories containing Jupyter server logs
• Monitor for unusual authentication patterns that could indicate session hijacking

How to Mitigate CVE-2022-24758

Immediate Actions Required

• Upgrade Jupyter Notebook to version 6.4.9 or later immediately
• Review and rotate all active authentication tokens and session cookies
• Restrict file system permissions on Jupyter server log files to root-only access where possible
• Audit log files for any previously exposed sensitive credentials

Patch Information

Jupyter Notebook version 6.4.9 contains the official patch for this vulnerability. The fix addresses the logging behavior to prevent sensitive authentication headers from being written to log files during error conditions. Users should upgrade using pip:

pip install --upgrade notebook>=6.4.9

For more details, refer to the GitHub Security Advisory.

Workarounds

• Restrict file system permissions on Jupyter log directories to prevent unauthorized users from reading logs
• Configure external log management to redact sensitive headers before storage
• Consider running Jupyter in isolated environments where log access is strictly controlled

# Restrict log file permissions (temporary mitigation)
chmod 600 /path/to/jupyter/logs/*.log
chown root:root /path/to/jupyter/logs/*.log