github - GHSA-p6rw-44q7-3fw4

GHSA-P6RW-44Q7-3FW4

Vulnerability from github – Published: 2021-11-08 18:09 – Updated: 2024-10-01 19:31

Summary

Stored XSS in Jupyter nbdime

Details

Impact

Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.

Patches

Security patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.

Python

nbdime 1.x: Patched in v. 1.1.1
nbdime 2.x: Patched in v. 2.1.1
nbdime 3.x: Patched in v. 3.1.1

npm

nbdime 6.x version: Patched in 6.1.2
nbdime 5.x version: Patched in 5.0.2
nbdime-jupyterlab 1.x version: Patched in 1.0.1
nbdime-jupyterlab 2.x version: Patched in 2.1.1

For more information

If you have any questions or comments about this advisory email us at security@ipython.org.

Severity ?

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nbdime-jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nbdime-jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41134"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-03T18:13:40Z",
    "nvd_published_at": "2021-11-03T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nImproper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.\n\n### Patches\n\nSecurity patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.\n\n#### Python\n- nbdime 1.x: Patched in v. 1.1.1\n- nbdime 2.x: Patched in v. 2.1.1\n- nbdime 3.x: Patched in v. 3.1.1\n\n#### npm\n- nbdime 6.x version: Patched in 6.1.2\n- nbdime 5.x version: Patched in 5.0.2\n- nbdime-jupyterlab 1.x version: Patched in 1.0.1\n- nbdime-jupyterlab 2.x version: Patched in 2.1.1\n\n### For more information\nIf you have any questions or comments about this advisory email us at [security@ipython.org](mailto:security@ipython.org).\n\n\n",
  "id": "GHSA-p6rw-44q7-3fw4",
  "modified": "2024-10-01T19:31:58Z",
  "published": "2021-11-08T18:09:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41134"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter/nbdime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nbdime/PYSEC-2021-428.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Stored XSS in Jupyter nbdime"
}

CVE-2021-41134 (GCVE-0-2021-41134)

Vulnerability from cvelistv5 – Published: 2021-11-03 17:50 – Updated: 2024-08-04 02:59

Summary

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.

Severity ?

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jupyter/nbdime/security/adviso…	x_refsource_CONFIRM
	https://github.com/jupyter/nbdime/commit/e44a5cc7…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jupyter	nbdime	Affected: < 1.1.1 - nbdime (pip) Affected: >= 2.0.0 , < 2.1.1 - nbdime (pip) Affected: >= 3.0.0, < 3.1.1 - nbdime (pip) Affected: < 5.0.2 - nbdime (npm) Affected: >= 6.0.0, < 6.1.2 - nbdime (npm) Affected: < 1.0.1 - nbdime-jupyterlab (npm) Affected: >= 2.0.0, < 2.1.1 - nbdime-jupyterlab (npm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.698Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nbdime",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1 - nbdime (pip)"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0 , \u003c 2.1.1 - nbdime (pip)"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.1.1 - nbdime (pip)"
            },
            {
              "status": "affected",
              "version": "\u003c 5.0.2 - nbdime (npm)"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.1.2 - nbdime (npm)"
            },
            {
              "status": "affected",
              "version": "\u003c 1.0.1 - nbdime-jupyterlab (npm)"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.1 - nbdime-jupyterlab (npm)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-03T17:50:10",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"
        }
      ],
      "source": {
        "advisory": "GHSA-p6rw-44q7-3fw4",
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS in Jupyter nbdime",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41134",
          "STATE": "PUBLIC",
          "TITLE": "Stored XSS in Jupyter nbdime"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "nbdime",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.1.1 - nbdime (pip)"
                          },
                          {
                            "version_value": "\u003e= 2.0.0 , \u003c 2.1.1 - nbdime (pip)"
                          },
                          {
                            "version_value": "\u003e= 3.0.0, \u003c 3.1.1 - nbdime (pip)"
                          },
                          {
                            "version_value": "\u003c 5.0.2 - nbdime (npm)"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.1.2 - nbdime (npm)"
                          },
                          {
                            "version_value": "\u003c 1.0.1 - nbdime-jupyterlab (npm)"
                          },
                          {
                            "version_value": "\u003e= 2.0.0, \u003c 2.1.1 - nbdime-jupyterlab (npm)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "jupyter"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4",
              "refsource": "CONFIRM",
              "url": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"
            },
            {
              "name": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea",
              "refsource": "MISC",
              "url": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-p6rw-44q7-3fw4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41134",
    "datePublished": "2021-11-03T17:50:10",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T02:59:31.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

PYSEC-2021-428

Vulnerability from pysec - Published: 2021-11-03 18:15 - Updated: 2021-11-16 21:20

Details

Impacted products

Name	purl
nbdime	pkg:pypi/nbdime

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nbdime",
        "purl": "pkg:pypi/nbdime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e44a5cc7677f24b45ebafc756db49058c2f750ea"
            }
          ],
          "repo": "https://github.com/jupyter/nbdime",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            },
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.1.1"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.0.dev",
        "0.1.0b1",
        "0.1.1",
        "0.1.2",
        "0.2.0",
        "0.3.0",
        "0.4.0",
        "0.4.1",
        "1.0.0",
        "1.0.0rc0",
        "1.0.0rc1",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.1.0",
        "2.0.0",
        "2.1.0",
        "3.0.0",
        "3.1.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41134",
    "GHSA-p6rw-44q7-3fw4"
  ],
  "details": "nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.",
  "id": "PYSEC-2021-428",
  "modified": "2021-11-16T21:20:29.137127Z",
  "published": "2021-11-03T18:15:00Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-P6RW-44Q7-3FW4

Impact

Patches

Python

npm

For more information

CVE-2021-41134 (GCVE-0-2021-41134)

PYSEC-2021-428

Tags

Sightings

Nomenclature