If you use Jupyter Scheduler for handling tasks in your JupyterLab environment, it’s important to pay attention to a recent security issue: CVE-2024-28188. This post will break down what’s going on, how it works, and how you can stay safe. Let’s get started.

What Is Jupyter Scheduler?

Jupyter Scheduler is a collection of JupyterLab extensions that let users program tasks — to run jobs immediately or on a schedule. It’s helpful for automating data analysis, machine learning workflows, or anything you’d like to automate in your Jupyter environment.

The Issue

With CVE-2024-28188, it was discovered that Jupyter Scheduler could leak the list of conda environments available to its users. When someone accessed the scheduler, they might be able to see all available environment names—even those belonging to other users.

Since conda environment names often reflect specific projects, datasets, or companies, this could unintentionally reveal information about what projects other users are working on. For example, you might spot environments called merger_2024, client_project_xyz, or secret_ai_model.

Why Does This Matter?

- Information Disclosure: Project codenames, client names, or other sensitive internal identifiers could be revealed.

Privacy Loss: Other users lose privacy around what they are building or testing.

- Potential Recon for Attackers: An attacker or curious user could focus their next attacks on known projects.

Here’s how the vulnerability could be exploited

1. Authorized Access Required: The attacker needs access to a JupyterLab where the Jupyter Scheduler extension is enabled.
2. API Route: Jupyter Scheduler provides an API endpoint to list available environments for scheduling jobs.
3. Unrestricted Environment Listing: Previously, this endpoint would list *all* environments—regardless of user permissions.

Suppose the scheduler was running; an authenticated user could simply do

curl -X GET http://<your-jupyter-scheduler>/schedules/environments

And the response would return a list like

[
  "base",
  "data_science",
  "client_project_xyz",
  "merger_2024",
  "secret_ai_model"
]

Any user with Jupyter account access could query this list and see everyone’s environments—even if they should not have this visibility.

The source code responsible could look something like

# Inside Jupyter Scheduler extension

def list_environments():
    return subprocess.check_output([
        "conda", "info", "--envs"
    ]).decode()

Problem: No checks if the environments belong to the requesting user or not. The output includes all environments visible from the scheduler’s process.

2.5.2

These versions restrict what gets exposed and apply appropriate permissions when fetching environment lists.

If you’re on an older version, simply update

pip install --upgrade jupyter_scheduler
# or
conda update jupyter_scheduler

Check your version

python -m pip show jupyter_scheduler

Resources & Further Reading

- Official CVE Record for CVE-2024-28188
- Jupyter Scheduler GitHub Security Advisory
- Jupyter Scheduler Docs

Conclusion

If you use Jupyter Scheduler and haven’t updated it recently, it’s time to do so—especially if you’re in a shared or multi-user lab environment. CVE-2024-28188 is a reminder to always be careful with what information your tooling might be exposing.

Want more tips like this? Stay tuned for our next breakdown!

Timeline

Published on: 05/23/2024 12:15:10 UTC
Last modified on: 06/04/2024 18:03:51 UTC