CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.

• CWE-306
• CWE-306

• https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433Product
• https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9Patch
• https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03Patch
• https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4vVendor Advisory
• https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433Product
• https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9Patch
• https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03Patch
• https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4vVendor Advisory

Published

Mar 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28171 It is possible to perform a path traversal attack and write…8.1
• CVE-2024-28172Uncontrolled search path for some Intel(R) Trace Analyzer an…7.3
• CVE-2024-28173In JetBrains TeamCity between 2023.11 and 2023.11.4 custom b…4.3
• CVE-2024-28174In JetBrains TeamCity before 2023.11.4 presigned URL generat…5.8
• CVE-2024-28175Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2024-28176jose is JavaScript module for JSON Object Signing and Encryp…5.9
• CVE-2024-2818An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-28180Package jose aims to provide an implementation of the Javasc…4.3
• CVE-2024-28181 turbo_boost-commands is a set of commands to help you build…8.1
• CVE-2024-28182nghttp2 is an implementation of the Hypertext Transfer Proto…5.3
• CVE-2024-28183ESP-IDF is the development framework for Espressif SoCs supp…5.7
• CVE-2024-28184WeasyPrint helps web developers to create PDF documents. Sin…7.4