A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NJupyter Server
APPJupyter2.17.0
Powiązane podatności
Stored XSS w Jupyter Server umożliwiający RCE przez nbconvert
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin vali...
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header ...
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to...
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal v...