CVE-2024-29033 (GCVE-0-2024-29033)

Vulnerability from cvelistv5 – Published: 2024-03-20 20:36 – Updated: 2024-08-02 01:03
VLAI?
Summary
OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
jupyterhub oauthenticator Affected: < 16.3.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-21T16:20:15.047713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:58:08.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:03:51.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"
          },
          {
            "name": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"
          },
          {
            "name": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oauthenticator",
          "vendor": "jupyterhub",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one\u0027s own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-20T20:36:13.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"
        },
        {
          "name": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"
        },
        {
          "name": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"
        }
      ],
      "source": {
        "advisory": "GHSA-55m3-44xf-hg4h",
        "discovery": "UNKNOWN"
      },
      "title": "GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-29033",
    "datePublished": "2024-03-20T20:36:13.595Z",
    "dateReserved": "2024-03-14T16:59:47.613Z",
    "dateUpdated": "2024-08-02T01:03:51.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one\u0027s own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.\"}, {\"lang\": \"es\", \"value\": \"OAuthenticator proporciona complementos para que JupyterHub utilice proveedores de OAuth comunes, as\\u00ed como clases base para escribir sus propios autenticadores con cualquier proveedor de OAuth 2.0. `GoogleOAuthenticator.hosted_domain` se utiliza para restringir a qu\\u00e9 cuentas de Google se les puede autorizar el acceso a un JupyterHub. La restricci\\u00f3n est\\u00e1 destinada a las cuentas de Google que forman parte de una o m\\u00e1s organizaciones de Google verificadas para controlar dominios espec\\u00edficos. Antes de la versi\\u00f3n 16.3.0, la restricci\\u00f3n real era para las cuentas de Google con correos electr\\u00f3nicos que terminaban con el dominio. Estas cuentas podr\\u00edan haber sido creadas por cualquier persona que en alg\\u00fan momento haya podido leer un correo electr\\u00f3nico asociado con el dominio. Esto fue descrito por Dylan Ayrey (@dxa4481) en esta [publicaci\\u00f3n de blog] del 15 de diciembre de 2023). OAuthenticator 16.3.0 contiene un parche para este problema. Como workaround, restrinja qui\\u00e9n puede iniciar sesi\\u00f3n de otra manera, como \\\"usuarios_permitidos\\\" o \\\"grupos_de_google_permitidos\\\".\"}]",
      "id": "CVE-2024-29033",
      "lastModified": "2024-11-21T09:07:24.973",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-03-20T21:15:31.593",
      "references": "[{\"url\": \"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-285\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-29033\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-03-20T21:15:31.593\",\"lastModified\":\"2025-12-03T19:52:15.043\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one\u0027s own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.\"},{\"lang\":\"es\",\"value\":\"OAuthenticator proporciona complementos para que JupyterHub utilice proveedores de OAuth comunes, as\u00ed como clases base para escribir sus propios autenticadores con cualquier proveedor de OAuth 2.0. `GoogleOAuthenticator.hosted_domain` se utiliza para restringir a qu\u00e9 cuentas de Google se les puede autorizar el acceso a un JupyterHub. La restricci\u00f3n est\u00e1 destinada a las cuentas de Google que forman parte de una o m\u00e1s organizaciones de Google verificadas para controlar dominios espec\u00edficos. Antes de la versi\u00f3n 16.3.0, la restricci\u00f3n real era para las cuentas de Google con correos electr\u00f3nicos que terminaban con el dominio. Estas cuentas podr\u00edan haber sido creadas por cualquier persona que en alg\u00fan momento haya podido leer un correo electr\u00f3nico asociado con el dominio. Esto fue descrito por Dylan Ayrey (@dxa4481) en esta [publicaci\u00f3n de blog] del 15 de diciembre de 2023). OAuthenticator 16.3.0 contiene un parche para este problema. Como workaround, restrinja qui\u00e9n puede iniciar sesi\u00f3n de otra manera, como \\\"usuarios_permitidos\\\" o \\\"grupos_de_google_permitidos\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.3.0\",\"matchCriteriaId\":\"B7209D57-DAC0-4AC0-9B38-897ED442A6F2\"}]}]}],\"references\":[{\"url\":\"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Press/Media Coverage\",\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Press/Media Coverage\",\"Technical Description\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-285\", \"lang\": \"en\", \"description\": \"CWE-285: Improper Authorization\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h\"}, {\"name\": \"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60\"}, {\"name\": \"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of\"}], \"affected\": [{\"vendor\": \"jupyterhub\", \"product\": \"oauthenticator\", \"versions\": [{\"version\": \"\u003c 16.3.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-20T20:36:13.595Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one\u0027s own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.\"}], \"source\": {\"advisory\": \"GHSA-55m3-44xf-hg4h\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29033\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-21T16:20:15.047713Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:19.160Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29033\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-03-14T16:59:47.613Z\", \"datePublished\": \"2024-03-20T20:36:13.595Z\", \"dateUpdated\": \"2024-06-04T17:58:08.797Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.