google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

AI PRP: Weak credential tester for jupyter lab/notebook through Jupyterhub #460

Open JamesFoxxx opened 2 months ago

JamesFoxxx commented 2 months ago

With Jupyterhub we can have multiple users with different environments. Multiple authentication mechanisms exist. one of these methods is DummyAuthenticator which has a configuration like c.DummyAuthenticator.password = "some_password" and it sets a global password for all users wanting to log in.

According to the following documentation example config, it is likely that users set up Jupyterhub with a default password ( which is some_password). One default username exists in all systems and is root so It can be used to test the default password.

https://jupyterhub.readthedocs.io/en/latest/tutorial/getting-started/authenticators-users-basics.html#use-dummyauthenticator-for-testing https://jupyterhub.readthedocs.io/en/latest/contributing/setup.html#using-dummyauthenticator-simplelocalprocessspawner https://github.com/jupyterhub/jupyterhub/blob/main/examples/external-oauth/jupyterhub_config.py#L40 https://github.com/jupyterhub/jupyterhub/blob/main/examples/azuread-with-group-management/jupyterhub_config.py#L27

Also, there are SimpleSpawner and SimpleLocalProcessSpawner where we can log in with any existing or non-existing user/password. the configurations are: https://github.com/jupyterhub/jupyterhub/blob/main/demo-image/jupyterhub_config.py https://github.com/jupyterhub/jupyterhub/blob/main/testing/jupyterhub_config.py