Jupyter Enterprise Gateway Server Side Template Injection Vulnerability Leading to Remote Code Execution

A server side template injection vulnerability has been identified in Jupyter Enterprise Gateway versions 2.0.0rc2 and above, prior to 3.3.0. This vulnerability allows for remote code execution by injecting Jinja2 template expressions into environment variables used during the rendering of Kubernetes manifests. The executed code can access the Kubernetes service account token, potentially leading to a full compromise of the Kubernetes cluster by scheduling privileged pods or pods with hostPath volume mounts.

Impact

Exploitation of this vulnerability allows for remote code execution in the context of the Jupyter Enterprise Gateway pod. The vulnerability also allows for theft and misuse of the Kubernetes service account token, which can be used to access Kubernetes secrets and fully compromise the Kubernetes cluster by scheduling privileged pods or pods with hostPath volume mounts.

Reproduction

To reproduce this vulnerability, create a kernel in a vulnerable version of Jupyter Enterprise Gateway by sending a request to the kernels API. Include an environment variable 'KERNEL_POD_NAME' with a value that includes a Jinja2 template expression, such as '{{7 * 7}}'. Once the kernel is created, the pod name will be processed as a template, and the injected expression will be evaluated. This can be verified by checking the name of the created pod, which will reflect the result of the evaluated expression. For remote code execution, the 'KERNEL_POD_NAME' variable can be set to execute OS commands, such as using 'os.popen' to read the output of a command.

Remediation

Users can upgrade to Jupyter Enterprise Gateway version 3.3.0, which addresses this vulnerability by fixing the Jinja2 template rendering in Kubernetes manifest injections.