Stored XSS in JupyterLab Git Extension via Malicious Filename

Executive Summary

This vulnerability exists in the JupyterLab Git extension versions from 0.30.0b3 up to before 0.54.0. The issue is in the PlainTextDiff.ts createHeader() method, which passes Git filenames directly to innerHTML when rendering renamed files in the commit history. Because of this, a specially crafted filename can contain malicious JavaScript code that executes when a user views the rename diff in the Git History tab.

The vulnerability allows an attacker to inject and execute JavaScript code in the context of the victim's browser when they view the affected Git history.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects JupyterLab Git versions from 0.30.0b3 before 0.54.0. Detection involves identifying if these vulnerable versions are installed on your system.

You can check the installed version of the jupyterlab_git extension by running the following command in your terminal or Jupyter environment:

• jupyter labextension list

Look for the jupyterlab_git extension and verify its version. If the version is between 0.30.0b3 and before 0.54.0, your system is vulnerable.

Additionally, you can inspect the installed Python package version with:

• pip show jupyterlab-git

If the version is vulnerable, consider upgrading to version 0.54.0 or later to mitigate the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript code in the victim's browser. This can result in unauthorized actions such as stealing sensitive information, hijacking user sessions, or performing actions on behalf of the user without their consent.

Because the vulnerability requires the victim to view the rename diff in the Git History tab, it relies on user interaction, but the impact is high due to the potential for remote code execution within the browser.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a critical stored cross-site scripting (XSS) issue that can lead to remote code execution (RCE) within the JupyterLab environment. Such a vulnerability can compromise the confidentiality, integrity, and availability of data processed or stored within affected systems.

Because it allows execution of arbitrary code and potential unauthorized access to sensitive data, this vulnerability could negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Specifically, exploitation could lead to unauthorized data disclosure or manipulation, violating principles of data security and privacy mandated by these standards.

Mitigation and patching (upgrading to version 0.54.0 or later) are essential to maintain compliance and reduce risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade JupyterLab Git to version 0.54.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0