Collected research

Leaking Jupyter instance auth token chaining CVE-2023-39968, CVE-2024-22421 and a chromium bug

Davwwwx · /blog.xss.am/ · 30 August 2023

Chains a client-side path traversal in JupyterLab's clone workspace parameter with an open redirect reachable because Python's URL parser finds no netloc in a triple-slash URL, and a Chromium bug that preserved custom request headers across a cross-origin redirect. One link sends the victim's Jupyter tokens to the attacker.

Record

Researcher

Davwwwx

Published by

/blog.xss.am/

Date

30 August 2023

Format

Advisory

Topic

Other

In the archive

• Collected in the 2024 research round

Related sources

• Chromium token-leak demonstration
• Reflection Logger extension

Tags

• path-traversal
• open-redirect
• info-leak
• url-parsing
• cors
• cve
• attack-chain
• python
• bug-bounty
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Davwwwx, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.