Cross-site request forgery in the REST API in IPython 2 and 3.

The remote Ubuntu 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5953-1 advisory.

    It was discovered that IPython incorrectly processed REST API POST requests. An attacker could possibly     use this issue to launch a cross-site request forgery (CSRF) attack and leak user's sensitive information.
    This issue only affected Ubuntu 14.04 ESM. (CVE-2015-5607)

    It was discovered that IPython did not properly manage cross user temporary files. A local attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 ESM and Ubuntu     20.04 ESM. (CVE-2022-21699)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix CSRF issue.

  - Fix font-awesome paths (bug #1219956)

    - Add upstream patch to fix PyQt4 import (bug #1219997)

    - Use python2 macros, fix python3 shebang fix Fix       fontawesome path

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kyle Kelley reports :

Summary: POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery (CSRF). Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython cookies along with the requests. The response is blocked by the Same-Origin Policy, but the request isn't.

API paths with issues :

- POST /api/contents/<path>/<file>

- POST /api/contents/<path>/<file>/checkpoints

- POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>

- POST /api/kernels

- POST /api/kernels/<kernel_id>/<action>

- POST /api/sessions

- POST /api/clusters/<cluster_id>/<action>

ID	Name	Product	Family	Severity
172574	Ubuntu 18.04 ESM / 20.04 ESM : IPython vulnerabilities (USN-5953-1)	Nessus	Ubuntu Local Security Checks	high
85091	Fedora 21 : ipython-2.4.1-7.fc21 (2015-11767)	Nessus	Fedora Local Security Checks	high
85088	Fedora 22 : ipython-2.4.1-7.fc22 (2015-11677)	Nessus	Fedora Local Security Checks	high
84707	FreeBSD : devel/ipython -- CSRF possible remote execution vulnerability (81326883-2905-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-5607

high

Tenable Plugins

high

high

high

high