{"id":"GHSA-gcv9-6737-pjqw","summary":"SSRF vulnerability in jupyter-server-proxy","details":"### Impact\n\n**What kind of vulnerability is it?**  Server-Side Request Forgery ( SSRF )\n\n**Who is impacted?** Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. \n\nA lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.\n\n\n### Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\nUpgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open a topic [on our forum](https://discourse.jupyter.org)\n* Email the Jupyter security team at [security@ipython.org](mailto:security@ipython.org)\n","aliases":["CVE-2022-21697","PYSEC-2022-16"],"modified":"2024-09-24T18:48:55.880796Z","published":"2022-01-27T16:24:26Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-01-25T20:57:43Z","nvd_published_at":"2022-01-25T14:15:00Z","cwe_ids":["CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21697"},{"type":"WEB","url":"https://github.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e0783529436b99eb"},{"type":"WEB","url":"https://github.com/jupyterhub/jupyter-server-proxy"},{"type":"WEB","url":"https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2022-16.yaml"}],"affected":[{"package":{"name":"jupyter-server-proxy","ecosystem":"PyPI","purl":"pkg:pypi/jupyter-server-proxy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}],"versions":["1.0","1.0.1","1.0b1","1.0b2","1.0b4","1.0b5","1.0b6","1.0b7","1.0b8","1.0b9","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0","1.5.2","1.5.3","1.6.0","3.0.0","3.0.0rc1","3.0.1","3.0.2","3.1.0","3.2.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.2.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-gcv9-6737-pjqw/GHSA-gcv9-6737-pjqw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}]}