CVE-2024-39700 - Critical RCE Vulnerability Found in JupyterLab Extension Template

A critical Remote Code Execution (RCE) vulnerability, CVE-2024-39700, has been discovered in the JupyterLab extension template. This vulnerability affects the update-integration-tests.yml workflow carried out by the test option in the copier template for generating JupyterLab extensions.

For extension authors using this template and hosting their code on GitHub, it is highly recommended to update to the latest version of the template to resolve this issue.

To ensure a smooth and secure update, we have provided some guidelines for users who may have made changes to the update-integration-tests.yml file. We have also provided suggestions for users who are upgrading from a template version earlier than 4.3..

Code Snippet

The vulnerability resides in the update-integration-tests.yml workflow. The problematic code snippet within the workflow file is as follows:

jobs:
  update_tests:
    runs-on: ubuntu-latest
    steps:
      - name: Run integration test update workflow
        run: |
          # Vulnerable Code

The vulnerable JupyterLab extension template can be found at the following link

- Original JupyterLab extension template

Documentation and resources for the template can be found at

- JupyterLab Extension Developer Guide

Exploit Details

The RCE vulnerability allows an attacker to execute arbitrary code on the affected machine remotely. This can potentially lead to unauthorized access, data leakage, or disruption of services.

Upgrade the JupyterLab extension template to the latest version.

2. If you have made changes to the update-integration-tests.yml file, accept overwriting the changes and reapply your modifications later.

Temporarily disable GitHub Actions during the upgrade process.

4. Rebase all open pull requests created by untrusted users, as the actions may run using the version of the main branch when the pull request was originally generated.

For users who are updating the template from a version earlier than 4.3., it is advised to forgo the proposed changes to the release workflow for now, as additional configurations will be required.

In conclusion, it is crucial for developers using the JupyterLab extension template to upgrade as soon as possible to mitigate the potential risks posed by this RCE vulnerability. By following the guidelines provided, users can minimize disruptions to their development while ensuring a secure and stable environment for their projects.

Timeline

Published on: 07/16/2024 18:15:07 UTC
Last modified on: 07/17/2024 13:34:20 UTC