Auth bypass in Jupyter Oauthenticator
CVE-2024-29033
OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.
EPSS: 0.006 (44.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Jupyter Oauthenticator
- Jupyterhub Oauthenticator — versions < 16.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Technical Description, Third Party Advisory, x_refsource_MISC, Press/Media Coverage)
Frequently asked questions
- What is CVE-2024-29033?
- CVE-2024-29033 is a high-severity vulnerability in Jupyter Oauthenticator, classified under Improper Authorization. CVSS score: 7.5/10. Published 2024-03-20.
- How severe is CVE-2024-29033?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-29033 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.