CVE-2021-41194Critical· 9.1▾ MidnightImproper Access Control in jupyterhub-firstuseauthenticator
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
1.3% → 1.4%
When JupyterHub is used with FirstUseAuthenticator, the vulnerability allows unauthorized access to any user's account if create_users=True and the username is known or guessed.
Upgrade to jupyterhub-firstuseauthenticator to 1.0, or apply patch https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch
If you cannot upgrade, there is no complete workaround, but it can be mitigated.
If you cannot upgrade yet, you can disable user creation with c.FirstUseAuthenticator.create_users = False, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until you can patch or upgrade.
jupyterhub-firstuseauthenticator < 1.0.0Upgrade to a patched release:
jupyterhub-firstuseauthenticator 1.0.0