JupyterLab token leak via crafted-link redirect (used by AI notebooks)
Date: 2024-01
Affected: JupyterLab (with jupyter-server < 2.7.2)
Attack vector: auth-bypass
Category: real-world
Severity: Medium
CVE: CVE-2024-22421
CVSS: 6.5 ()

JupyterLab users clicking a malicious link may have their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server. Fixed in JupyterLab 4.1.0b2/4.0.11/3.6.7 and jupyter-server 2.7.2+.


Mitigations:

Architectural layers (MAESTRO):