CVE-2024-22421: Jupyter JupyterLab CSRF Vulnerability

CVE-2024-22421 Overview

CVE-2024-22421 is a token exposure vulnerability in JupyterLab, an extensible environment for interactive and reproducible computing based on Jupyter Notebook. Users who click a malicious link can have their Authorization and XSRFToken tokens leaked to a third-party host when the underlying jupyter-server version is outdated. The flaw stems from insufficient URL validation in the workspaces and hub-extension components, which allowed crafted paths to redirect authenticated users off the trusted origin. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7, alongside a required upgrade to jupyter-server 2.7.2 or newer, which contains the underlying redirect fix. The vulnerability is tracked under [CWE-23] (Relative Path Traversal).

Critical Impact
Successful exploitation exposes user Authorization and XSRFToken credentials to attacker-controlled infrastructure, enabling session hijacking against JupyterLab notebooks and connected compute resources.

Affected Products

Jupyter JupyterLab versions prior to 3.6.7, 4.0.11, and 4.1.0b2
Jupyter Notebook (bundled JupyterLab components)
Fedora Project Fedora 39

Discovery Timeline

2024-01-19 - CVE-2024-22421 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22421

Vulnerability Analysis

The vulnerability resides in JupyterLab client-side routing logic that constructs URLs for workspaces and JupyterHub spawn requests. The workspacesplugin.ts and hub-extension/src/index.ts modules joined attacker-influenced path segments without validating that the resulting URL remained within the intended base path. When combined with an unpatched jupyter-server open redirect, a crafted workspace identifier or hub server name could steer the browser to an external origin. Because JupyterLab attaches Authorization headers and XSRFToken values to outbound requests, those secrets were transmitted to the attacker-controlled endpoint. User interaction is required, but no authentication or elevated privileges are needed to trigger the flaw.

Root Cause

The underlying weakness is improper validation of relative path segments passed to URLExt.join. The code assumed that appending a workspace ID or hub server name to a base path would always yield a subpath of that base, but attacker-supplied values containing traversal or absolute-URL components broke that assumption. This maps to [CWE-23] Relative Path Traversal.

Attack Vector

Exploitation requires a victim to click a malicious link that targets a vulnerable JupyterLab instance. The link supplies a specially crafted workspace or spawn parameter, which the client resolves into an off-origin URL. Combined with the jupyter-server redirect flaw, the browser follows the redirect and leaks Authorization and XSRFToken values to the attacker. There are no public proof-of-concept exploits recorded and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

typescript

// Patch in packages/apputils-extension/src/workspacesplugin.ts
        await this._state.save(LAST_SAVE_ID, path);

        // Navigate to new workspace.
-        const url = URLExt.join(this._application, 'workspaces', id);
+        const workspacesBase = URLExt.join(this._application, 'workspaces');
+        const url = URLExt.join(workspacesBase, id);
+        if (!workspacesBase.startsWith(url)) {
+          throw new Error('Can only be used for workspaces');
+        }
        if (this._router) {
          this._router.navigate(url, { hard: true });
        } else {

Source: JupyterLab Commit 19bd9b9

typescript

// Patch in packages/hub-extension/src/index.ts
  // If hubServerName is set, use JupyterHub 1.0 URL.
-  const restartUrl = hubServerName
-    ? hubHost + URLExt.join(hubPrefix, 'spawn', hubUser, hubServerName)
-    : hubHost + URLExt.join(hubPrefix, 'spawn');
+  const spawnBase = URLExt.join(hubPrefix, 'spawn');
+  let restartUrl: string;
+  if (hubServerName) {
+    const suffix = URLExt.join(spawnBase, hubUser, hubServerName);
+    if (!suffix.startsWith(spawnBase)) {
+      throw new Error('Can only be used for spawn requests');
+    }
+    restartUrl = hubHost + suffix;
+  }
+  restartUrl = hubHost + spawnBase;

Source: JupyterLab Commit 19bd9b9

The fixes introduce explicit startsWith checks that reject any resolved URL falling outside the intended base path, throwing an error rather than issuing the navigation.

Detection Methods for CVE-2024-22421

Indicators of Compromise

HTTP redirects originating from /workspaces/ or /hub/spawn/ endpoints to external hosts in JupyterLab or JupyterHub access logs.
Outbound requests from user browsers containing Authorization: token headers directed at non-organizational domains shortly after a JupyterLab session.
Reused JupyterLab session tokens observed from unfamiliar IP addresses or user agents.

Detection Strategies

Inspect proxy and web-server logs for JupyterLab requests carrying workspace identifiers with encoded protocol schemes (for example %2F%2Fattacker.example).
Correlate jupyter-server versions across managed hosts and flag any deployment below 2.7.2 as exposed to the enabling redirect flaw.
Alert on JupyterLab authentication events immediately followed by session activity from a different geographic region or ASN.

Monitoring Recommendations

Enable verbose access logging on jupyter-server and forward events to a central log store for retention and search.
Track installed JupyterLab and jupyter-server package versions in software inventory to identify unpatched instances.
Monitor egress traffic from analyst workstations for anomalous connections to newly registered or low-reputation domains during Jupyter sessions.

How to Mitigate CVE-2024-22421

Immediate Actions Required

Upgrade JupyterLab to version 4.1.0b2, 4.0.11, or 3.6.7 on all deployments.
Upgrade jupyter-server to version 2.7.2 or later to remove the underlying redirect flaw that this vulnerability chains against.
Rotate any JupyterLab API tokens and JupyterHub credentials that may have been used since the vulnerable version was deployed.
Warn users against clicking JupyterLab or JupyterHub links from untrusted sources until patching is complete.

Patch Information

The fix is delivered through commit 19bd9b96cb2e77170a67e43121637d0b5619e8c6, which adds base-path validation in both workspacesplugin.ts and hub-extension/src/index.ts. Full details are available in the GitHub Security Advisory GHSA-44cc-43rp-5947. Fedora 39 users should apply the update referenced in the Fedora Package Announcement.

Workarounds

No application-level workaround exists inside JupyterLab itself; the JupyterLab maintainers state that upgrading is required.
Place JupyterLab behind a reverse proxy configured to strip or block off-origin redirects as a defense-in-depth control until patches are deployed.
Restrict JupyterLab access to authenticated users on trusted networks or via VPN to reduce exposure to phishing-delivered malicious links.

bash

# Upgrade JupyterLab and jupyter-server to patched releases
pip install --upgrade "jupyterlab>=4.0.11" "jupyter-server>=2.7.2"

# Verify installed versions
jupyter lab --version
python -c "import jupyter_server; print(jupyter_server.__version__)"