The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote
    attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/,
    related to MIME types. (CVE-2015-7337)

The remote host is affected by the vulnerability described in GLSA-201512-02 (IPython: User-assisted execution of arbitrary code)

    IPython does not properly check the MIME type of a file.
  Impact :

    A remote attacker could entice a user to open a specially crafted text       file using IPython, possibly resulting in execution of arbitrary       JavaScript with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

Matthias Bussonnier reports :

Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.

URI with issues :

- GET /tree/**

Benjamin RK reports :

Vulnerability: A maliciously forged file opened for editing can execute JavaScript, specifically by being redirected to /files/ due to a failure to treat the file as plain text.

URI with issues :

- GET /edit/**

Add upstream patch to fix file execution vulnerability (bug #1264067)
---- Add upstream patch to fix XSS vulnerability (bug #1259405)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
412962	SCA: security update for ipython, notebook (GHSA-92mr-v722-f48m)	Tenable Cloud Security	SCA Checks	critical
412962	SCA: security update for ipython, notebook (GHSA-92mr-v722-f48m)	Tenable Self-Hosted Container Security	SCA Checks	critical
87485	GLSA-201512-02 : IPython: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
86335	FreeBSD : devel/ipython -- multiple vulnerabilities (290351c9-6f5c-11e5-a2a1-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
86174	Fedora 23 : ipython-3.2.1-3.fc23 (2015-16128)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-7337

critical

Tenable Plugins

critical

critical

medium

medium

medium