CVE-2022-29241: Jupyter Server Token Disclosure Flaw

CVE-2022-29241 Overview

CVE-2022-29241 is an Information Leakage vulnerability in Jupyter Server, the backend component that provides core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. When the notebook server is started with a root_dir value that contains the starting user's home directory, the underlying REST API can be exploited to leak the access token assigned at start time by guessing or brute forcing the PID of the jupyter server process.

Critical Impact

Successful exploitation allows attackers to steal access tokens and interact with Jupyter services to modify critical files such as .bashrc or .ssh/authorized_keys, potentially leading to full system compromise.

Affected Products

• Jupyter Server versions prior to 1.17.1
• Jupyter web applications utilizing vulnerable Jupyter Server backend
• Systems running Jupyter Server with root_dir containing user home directory

Discovery Timeline

• 2022-06-14 - CVE CVE-2022-29241 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-29241

Vulnerability Analysis

This vulnerability exists in Jupyter Server's REST API implementation when specific configuration conditions are met. When a Jupyter Server instance is started with a root_dir parameter that includes the starting user's home directory path, an authenticated attacker can leverage the REST API to extract the server's access token.

The attack requires an authenticated user session, but the vulnerable URL endpoint can be triggered from cross-site scripting (XSS) payloads or from compromised browser sessions. Once the attacker successfully guesses or brute forces the Jupyter server's process ID (PID), they can leak the access token to a malicious third party.

With the stolen token, attackers gain the ability to interact with Jupyter services and notebooks through the REST API. This includes reading sensitive data, modifying or overwriting critical system files like .bashrc or .ssh/authorized_keys, which could allow persistent unauthorized access or complete system takeover.

Root Cause

The vulnerability stems from improper access control in the REST API when the server is configured with a root_dir that overlaps with the user's home directory. The API endpoint inadvertently exposes the access token through a predictable mechanism tied to the server's process ID, creating an information disclosure pathway that can be exploited through brute force enumeration.

Attack Vector

The attack is network-based and requires low privileges (an authenticated user session). The attacker can exploit this vulnerability through several vectors:

1. Cross-Site Scripting (XSS): Injecting malicious scripts that query the vulnerable REST API endpoint to extract the access token
2. Compromised Browser Session: Leveraging an already hooked or compromised browser to make requests to the vulnerable endpoint
3. PID Brute Force: Systematically guessing the Jupyter server's process ID to successfully leak the token

The vulnerability allows attackers to escalate from a limited authenticated session to full control over Jupyter services, enabling file manipulation and potential system compromise.

Detection Methods for CVE-2022-29241

Indicators of Compromise

• Unusual volume of REST API requests targeting Jupyter Server endpoints
• Sequential or patterned requests attempting to enumerate process IDs
• Unexpected modifications to sensitive files such as .bashrc, .ssh/authorized_keys, or other home directory configuration files
• Access token usage from unfamiliar IP addresses or user agents

Detection Strategies

• Monitor Jupyter Server access logs for brute force patterns or enumeration attempts
• Implement rate limiting on REST API endpoints to detect and block excessive requests
• Deploy web application firewalls (WAF) to identify and block XSS payloads targeting Jupyter environments
• Audit file integrity for critical configuration files in user home directories

Monitoring Recommendations

• Enable verbose logging for Jupyter Server REST API access
• Set up alerts for unusual authentication patterns or token usage anomalies
• Monitor network traffic for unexpected connections to Jupyter Server ports
• Review system audit logs for unauthorized file modifications in home directories

How to Mitigate CVE-2022-29241

Immediate Actions Required

• Upgrade Jupyter Server to version 1.17.1 or later immediately
• Review current Jupyter Server configurations for root_dir settings that include user home directories
• Audit existing Jupyter Server deployments for potential indicators of compromise
• Rotate access tokens for all active Jupyter Server instances

Patch Information

This vulnerability is patched in Jupyter Server version 1.17.1. Organizations should update their Jupyter Server installations to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory GHSA-q874-g24w-4q9g.

Workarounds

• Configure Jupyter Server with a root_dir that does not include or overlap with the user's home directory
• Implement network segmentation to restrict access to Jupyter Server from untrusted networks
• Deploy additional authentication layers such as reverse proxies with authentication
• Disable or restrict REST API access where not required for operational purposes

# Example: Start Jupyter Server with a dedicated workspace directory
jupyter server --ServerApp.root_dir=/opt/jupyter/workspace

# Example: Verify current root_dir configuration
jupyter server --show-config | grep root_dir