Path Traversal in JupyterLab Git Extension

Executive Summary

This vulnerability exists in the JupyterLab Git extension prior to version 0.54.0. It involves the use of the fnmatch.fnmatchcase() function in the GitHandler.prepare() method to enforce excluded paths. On case-insensitive filesystems, an authenticated user can exploit this by varying the casing of URL paths to bypass the exclusion rules and gain access to directories that should be excluded.

Useful 0 Not Useful 0

Impact Analysis

An authenticated user could exploit this vulnerability to read directories that are meant to be excluded from access. This could lead to unauthorized disclosure of sensitive information stored in those directories, potentially compromising confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade jupyterlab-git to version 0.54.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user on case-insensitive filesystems to bypass directory exclusions and access sensitive files and git history in excluded directories. Such unauthorized access to sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

By enabling unauthorized reading of restricted files and git operations, the vulnerability undermines confidentiality and access control requirements mandated by these standards, potentially resulting in non-compliance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your JupyterLab Git extension version is 0.53.0 or earlier, as these versions are affected by the case-sensitivity bypass issue in excluded_paths.

To detect exploitation attempts on your system or network, monitor HTTP requests to the JupyterLab Git server for URL paths that vary only by case in segments that should be excluded. For example, requests to paths like /git/project/Secrets/status instead of /git/project/secrets/status may indicate attempts to bypass directory exclusions.

Suggested commands to help detect such attempts include using web server or application logs to search for case-variant URL requests targeting excluded directories.

• Using grep on access logs to find case-variant requests: grep -i '/git/project/secrets' /path/to/access.log
• Using curl to test if case variants of excluded paths are accessible (should return 404 if fixed): curl -i http://your-jupyterlab-server/git/project/Secrets/status
• Check the installed version of jupyterlab-git to confirm if it is vulnerable: pip show jupyterlab-git

Useful 0 Not Useful 0