CVE-2019-10255 (published 2019-03-28T16:29Z)

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/jupyter/notebook
commit_details: repo_url: https://github.com/jupyter/notebook
author: Min RK
author_date: 2019-03-27 16:19:10+01:00
msg: changelog for redirect check

and update cve for 5.7.6
repository: repo_url: https://github.com/jupyter/notebook
repo_name: jupyter/notebook
description: Jupyter Interactive Notebook
repo_language: Jupyter Notebook
owner: jupyter
file_changes: filename: changelog.rst
change_type: ModificationType.MODIFY
diff: @@ -31,13 +31,14 @@ We strongly recommend that you upgrade pip to version 9+ of pip before upgrading
 - Further improve compatibility with tornado 6 with improved
   checks for when websockets are closed.
 - Fix regression in 5.7.6 on Windows where .js files could have the wrong mime-type.
+- Fix Open Redirect vulnerability where certain malicious URLs could redirect from the Jupyter login page to a malicious site after a successful login. A CVE has been requested for this vulnerability.
 
 .. _release-5.7.6:
 
 5.7.6
 -----
 
-5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability,
+5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability (CVE-2019–9644),
 where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server.
 The fix involves setting the ``X-Content-Type-Options: nosniff``
 header, and applying CSRF checks previously on all non-GET
@@ -45,7 +46,6 @@ API requests to GET requests to API endpoints and the /files/ endpoint.
 
 The attacking page is able to access some contents of files when using Internet Explorer through script errors,
 but this has not been demonstrated with other browsers.
-A CVE has been requested for this vulnerability.
 
 .. _release-5.7.5:
 

programming_language: Markdown
repo_url: https://github.com/jupyter/notebook
commit_details: repo_url: https://github.com/jupyter/notebook
author: Min RK
author_date: 2019-03-27 21:43:40+01:00
msg: protect against chrome mishandling backslash as slash in URLs
repository: repo_url: https://github.com/jupyter/notebook
repo_name: jupyter/notebook
description: Jupyter Interactive Notebook
repo_language: Jupyter Notebook
owner: jupyter
file_changes: filename: login.py
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,10 @@ class LoginHandler(IPythonHandler):
         """
         if default is None:
             default = self.base_url
+        # protect chrome users from mishandling unescaped backslashes.
+        # \ is not valid in urls, but some browsers treat it as /
+        # instead of %5C, causing `\\` to behave as `//`
+        url = url.replace("\\", "%5C")
         parsed = urlparse(url)
         if parsed.netloc or not (parsed.path + '/').startswith(self.base_url):
             # require that next_url be absolute path within our path

programming_language: Python