CVE-2015-6938

IPython/Jupyter Notebook 3.2.2 and 4.0.x File Browser XSS.

• CVSS 4.3
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

CVE

CVE-2015-6938

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

4.3

Published

2015-09-02

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Jupyter Notebook version 4.0.5 or higher

def create_folder(folder_name):
    """Vulnerable function that demonstrates the security issue."""
    folder_path = '/path/to/folders/' + folder_name


create_folder("<script>alert('XSS');</script>")

import urllib.parse
from notebook.utils import url_path_join

def function_folder_name(folder_name):
    """Secure function that fixes the vulnerability."""
    return urllib.parse.quote(folder_name, safe='')

def create_folder(folder_name):
    """Secure function that fixes the vulnerability."""
    modified_name = function_folder_name(folder_name)
    if not modified_name.isalnum() and not modified_name.replace('-', '').replace('_', '').isalnum():
        print("Invalid folder name.")
        return
    folder_path = url_path_join('/path/to/folders', modified_name)

create_folder("<script>alert('XSS');</script>")

@misc{vaitp:cve20156938,
  title        = {{IPython/Jupyter Notebook 3.2.2 and 4.0.x File Browser XSS.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2015},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-6938},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-6938/}}
}