SB2024012331 - Multiple vulnerabilities in JupyterLab

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2024-22421)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to improper input validation. A remote attacker can trick a victim to visit a specially crafted website and read arbitrary files on the system.

2) Cross-site scripting (CVE-ID: CVE-2024-22420)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Markdown Preview. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
• https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df