IPython Notebook Cross 2014-3429

[Kyle Kelley <rgbkrk () gmail com>]

Hey OSS Security list,

We posted details to MITRE back in early May and got assigned a CVE number
(CVE-2014-3429) but haven't seen details been posted yet. It has been
patched for some time now. In the interest of full disclosure, I'm
providing the same details to this list.

Email address of requester: security () ipython org; rgbkrk () gmail com
Software name: IPython notebook
Type of vulnerability: Cross domain websocket hijacking
Attack outcome: Remote execution
Patch/issue: https://github.com/ipython/ipython/pull/4845
Changelog:
http://ipython.org/ipython-doc/stable/whatsnew/github-stats-2.0.html
Affected versions: 0.12 ≤ version < 1.2

Summary: The origin of websocket requests was not verified within the
IPython notebook server. If an attacker has knowledge of an IPython kernel
id they can run arbitrary code on a user's machine when the client visits a
crafted malicious page.

Post on our own mailing list:
http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198 Note:
truncated CVE was posted to the mailing list, corrected after (my bad).

Thank you,

Kyle Kelley