CVE-2015-4707

IPython < 3.2 XSS in /api/notebooks

• CVSS 6.1
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

CVE

CVE-2015-4707

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2017-09-20

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to IPython version 3.2 or higher

import json
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/api/notebooks', methods=['POST'])
def create_notebook():
    data = request.json
    if not data or 'name' not in data:
        error_message = "Invalid notebook data."
        return jsonify({'error': error_message}), 400

    notebook_name = data['name']
    
    return jsonify({'message': f'Notebook {notebook_name} created successfully!'}), 201

if __name__ == '__main__':
    app.run()

import json
from flask import Flask, request, jsonify, escape

app = Flask(__name__)

@app.route('/api/notebooks', methods=['POST'])
def create_notebook():
    data = request.json
    if not data or 'name' not in data:
        error_message = escape("Invalid notebook data.")
        return jsonify({'error': error_message}), 400

    notebook_name = escape(data['name'])
    
    return jsonify({'message': f'Notebook {notebook_name} created successfully!'}), 201

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20154707,
  title        = {{IPython < 3.2 XSS in /api/notebooks}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-4707},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-4707/}}
}