CVE-2015-7337

IPython/Jupyter Notebook 3.2.2 and 4.0.x JavaScript Code Execution

• CVSS 6.8
• CWE-20
• Configuration Issues
• Remote

The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.

CVE

CVE-2015-7337

CWE

CWE-20

CVSS base score

6.8

Published

2015-09-29

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Build/Package/Merge

Code defect classification

Packaging Issues

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Jupyter Notebook version 4.0.5 or higher

import mimetypes

def handle_uploaded_file(file):
    mime_type, _ = mimetypes.guess_type(file.filename)
    if mime_type.startswith('text/'):
        with open(file.filename, 'r') as f:
            content = f.read()
            exec(content)
    else:
        print("Unsupported file type.")

import mimetypes

def handle_uploaded_file(file):
    mime_type, _ = mimetypes.guess_type(file.filename)
    if mime_type.startswith('text/'):
        content = file.read().decode('utf-8')
        if any(keyword in content for keyword in ["exec", "import", "os", "sys"]):
            print("Potentially dangerous content detected.")
        else:
            print("Safe to process the content.")
    else:
        print("Unsupported file type.")

@misc{vaitp:cve20157337,
  title        = {{IPython/Jupyter Notebook 3.2.2 and 4.0.x JavaScript Code Execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2015},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-7337},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-7337/}}
}