CVE-2021-32862

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches

Below is currently a duplicate of the original report:

Received on [email protected] unedited, I'm not sure if we want to make it separate advisories.

Pasted raw for now, feel free to edit or make separate advisories if you have the rights to.

I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well.

Impact

What kind of vulnerability is it? Who is impacted?

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in example link to repo
• Email us at example email address

GitHub Security Lab (GHSL) Vulnerability Report

The GitHub Security Lab team has identified potential security vulnerabilities in nbconvert.

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at [email protected] (please include GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 as a reference).

If you are NOT the correct point of contact for this report, please let us know!

Summary

When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to Cross-Site Scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer)

Product

nbconvert

Tested Version

v5.5.0

Details

Issue 1: XSS in notebook.metadata.language_info.pygments_lexer (GHSL-2021-1013)

Attacker in control of a notebook can inject arbitrary unescaped HTML in the notebook.metadata.language_info.pygments_lexer field such as the following:

"metadata": {
  "language_info": {
   "pygments_lexer": "ipython3-foo\"><script>alert(1)</script>"
  }
}

This node is read in the from_notebook_node method:

def from_notebook_node(self, nb, resources=None, **kw):
  langinfo = nb.metadata.get('language_info', {})
  lexer = langinfo.get('pygments_lexer', langinfo.get('name', None))
  highlight_code = self.filters.get('highlight_code', Highlight2HTML(pygments_lexer=lexer, parent=self))
  self.register_filter('highlight_code', highlight_code)
  return super().from_notebook_node(nb, resources, **kw)

It is then assigned to language var and passed down to _pygments_highlight

from pygments.formatters import LatexFormatter
if not language:
  language=self.pygments_lexer
latex = _pygments_highlight(source, LatexFormatter(), language, metadata)

In this method, the language variable is concatenated to highlight hl- string to conform the cssclass passed to the…

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches

Below is currently a duplicate of the original report:

Received on [email protected] unedited, I'm not sure if we want to make it separate advisories.

Pasted raw for now, feel free to edit or make separate advisories if you have the rights to.

I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well.

Impact

What kind of vulnerability is it? Who is impacted?

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

• Open an issue in example link to repo
• Email us at example email address

GitHub Security Lab (GHSL) Vulnerability Report

The GitHub Security Lab team has identified potential security vulnerabilities in nbconvert.

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at [email protected] (please include GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 as a reference).

If you are NOT the correct point of contact for this report, please let us know!

Summary

When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to Cross-Site Scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer)

Product

nbconvert

Tested Version

v5.5.0

Details

Issue 1: XSS in notebook.metadata.language_info.pygments_lexer (GHSL-2021-1013)

Attacker in control of a notebook can inject arbitrary unescaped HTML in the notebook.metadata.language_info.pygments_lexer field such as the following:

"metadata": {
  "language_info": {
   "pygments_lexer": "ipython3-foo\"><script>alert(1)</script>"
  }
}

This node is read in the from_notebook_node method:

def from_notebook_node(self, nb, resources=None, **kw):
  langinfo = nb.metadata.get('language_info', {})
  lexer = langinfo.get('pygments_lexer', langinfo.get('name', None))
  highlight_code = self.filters.get('highlight_code', Highlight2HTML(pygments_lexer=lexer, parent=self))
  self.register_filter('highlight_code', highlight_code)
  return super().from_notebook_node(nb, resources, **kw)

It is then assigned to language var and passed down to _pygments_highlight

from pygments.formatters import LatexFormatter
if not language:
  language=self.pygments_lexer
latex = _pygments_highlight(source, LatexFormatter(), language, metadata)

In this method, the language variable is concatenated to highlight hl- string to conform the cssclass passed to the…

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).