Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-22415

CVE-2024-22415: Unsecured endpoints in the jupyter-lsp server extension

7.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-22415
GHSA ID
GHSA-4qhp-652w-c22x
EPSS Score
0.3855%
CWE
CWE-22
Published
1/18/2024
Updated
1/30/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
jupyter-lsppip<= 2.2.12.2.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two main issues: 1) Missing authentication in WebSocket/REST handlers (CWE-306) and 2) Path traversal via unvalidated URI-to-path conversion (CWE-22/23). The patch adds auth decorators (@web.authenticated, @authorized) to handlers and implements is_relative path validation. The vulnerable functions were directly handling network endpoints without security checks and processing file paths without containment validation. Test cases like test_shadow_traversal validate the path traversal fix, confirming this was an attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Inst*ll*tions o* jupyt*r-lsp runnin* in *nvironm*nts wit*out *on*i*ur** *il* syst*m ****ss *ontrol (on t** op*r*tin* syst*m l*v*l), *n* wit* jupyt*r-s*rv*r inst*n**s *xpos** to non-trust** n*twork *r* vuln*r**l* to un*ut*oris** ****ss *n*

Reasoning

T** vuln*r**ility st*ms *rom two m*in issu*s: *) Missin* *ut**nti**tion in W**So*k*t/R*ST **n*l*rs (*W*-***) *n* *) P*t* tr*v*rs*l vi* unv*li**t** URI-to-p*t* *onv*rsion (*W*-**/**). T** p*t** ***s *ut* ***or*tors (@w**.*ut**nti**t**, @*ut*oriz**) to