CVE-2024-41942: JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
Summary
If a user is granted the admin:users scope, they may escalate their own privileges by making themselves a full admin user.
Details
The admin:users scope allows a user to edit user records:
> admin:users > > Read, write, create and delete users and their authentication state, not including their servers or tokens. > > -- https://jupyterhub.readthedocs.io/en/stable/rbac/scopes.html#available-scopes
However, this includes making users admins. Admin users are granted scopes beyond admin:users making this a mechanism by which granted scopes may be escalated.
Impact
The impact is relatively small in that admin:users is already an extremely privileged scope only granted to trusted users. In effect, admin:users is equivalent to admin=True, which is not intended.
Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. groups permissions from granting themselves or other users permissions via group membership, which is intentional.
Other sources
JupyterHub could allow a remote authenticated attacker to gain elevated privileges on the system. If a user is granted the admin:users scope, they may escalate their own privileges by making themselves a full admin user.
— IBM
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the admin:users scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that admin:users is already an extremely privileged scope only granted to trusted users. In effect, admin:users is equivalent to admin=True, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. groups permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41942?
CVE-2024-41942 has a critical severity level due to the potential for privilege escalation.
How do I fix CVE-2024-41942?
To remediate CVE-2024-41942, upgrade to JupyterHub version 5.1.0 or above.
Which software versions are affected by CVE-2024-41942?
CVE-2024-41942 affects JupyterHub versions up to 5.0.0 and below, including several beta versions.
What type of vulnerability is CVE-2024-41942?
CVE-2024-41942 is a privilege escalation vulnerability.
Can users without admin:users scope exploit CVE-2024-41942?
Yes, users who have been granted the admin:users scope can exploit CVE-2024-41942 to escalate their privileges.