JupyterLab Cross-site Scripting via Crafted Settings File

JupyterLab versions 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1 are affected by a cross-site scripting (XSS) vulnerability related to improper validation of notebook display settings within the overrides.json file. This flaw, tracked as a GitHub Security Advisory (GHSA-pppj-hq3g-57pj) with a pending CVE, allows an attacker to embed malicious code within a crafted overrides.json file. When this file is either deliberately imported by a user via the Settings Editor's "Import" button or automatically applied due to write access on a multi-tenant file system, the embedded code executes within the victim's JupyterLab session. This enables an attacker to perform actions such as reading or modifying the user's notebooks and files, and running arbitrary code through the associated notebook server and kernels, thereby compromising the user's environment. The vulnerability stems from the expectation that settings files only modify display preferences, not execute code.

Attack Chain

1. Attacker crafts a malicious overrides.json file containing XSS payloads designed to bypass JupyterLab's validation for certain notebook display settings.
2. Initial Access Option 1 (User Interaction): Attacker delivers the malicious overrides.json to a victim, potentially via social engineering, and convinces them to import it through the JupyterLab Settings Editor's "Import" button.
3. Initial Access Option 2 (Privileged Write Access): Attacker with write access to a shared or multi-tenant file system places the malicious overrides.json in a directory from which JupyterLab automatically loads user settings.
4. JupyterLab loads and processes the malicious overrides.json file, either manually imported or automatically applied at startup.
5. Due to insufficient validation of the embedded settings, the XSS payload executes within the victim's JupyterLab session, running with the user's privileges.
6. The attacker's code gains the ability to read or modify the victim's notebooks and other associated files.
7. The attacker's code can execute arbitrary commands on the victim's behalf through the Jupyter notebook server, potentially interacting with connected computational kernels.
8. The ultimate objective is to compromise user data, intellectual property, or gain further access to the underlying infrastructure through the hijacked session.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the victim's JupyterLab session with the same privileges as the affected user. This directly translates to the ability to read, modify, and exfiltrate the user's notebooks and other files accessible through JupyterLab. Furthermore, the attacker can leverage the compromised session to run code on the user's behalf through the associated Jupyter notebook server, potentially interacting with any connected computational kernels. While no specific victim counts or targeted sectors are identified in the advisory, any organization utilizing JupyterLab, especially in shared or multi-tenant environments, is at risk of intellectual property theft, data manipulation, or unauthorized resource utilization.

Recommendation

• Upgrade JupyterLab to version 4.6.2 or 4.5.10 immediately to apply the security patches addressing the XSS vulnerability.
• Establish and enforce a trusted process for distributing JupyterLab configuration files, discouraging users from importing arbitrary overrides.json files from untrusted sources.
• For multi-tenant or shared file systems, restrict write permissions on JupyterLab application settings directories and other configuration paths to prevent unauthorized users from placing malicious overrides.json files that could be automatically loaded.