Jupyter Notebook Publish Mode getDocInfo API Leakage of Metadata for Password-Protected Docs

Vulnerability Overview Vulnerability Name: Publish readers can learn backlink block IDs and reference counts of password-protected and publish-disabled documents via and Vulnerability Description: In Jupyter Notebook, the and endpoints are registered with only (lacking or ), allowing Publish Mode readers (RoleReader JWT) or anonymous visitors to access these endpoints for password-protected or publish-disabled documents. These two endpoints return only the and of the requested document, even when the document itself is inaccessible. For normally published documents, an attacker can retrieve all block IDs and reference counts, including those from blocks located within password-protected and publish-disabled documents. Root Cause: The function in (lines 1246-1290) unconditionally clears and (lines 1285-1286). The condition only applies when the requested document itself is inaccessible (line 1279). and are unconditionally cleared from the workspace-scoped table ( ), which indexes all non-encrypted notebooks regardless of publish configuration, disabled/password status, publish attributes ( ), NOT index-level exclusions, etc. The correctly filtered executes (a per-element filter), removing all s from inaccessible documents, demonstrating that the maintainers intended backlink source IDs to be considered publish-sensitive. Impact: Publish readers can determine the existence, block IDs (each block ID encodes a creation timestamp), and total count of blocks in password-protected and publish-disabled documents—effectively revealing documents that were intended to be hidden. This is a metadata confidentiality vulnerability of the same category as accepted reports ( document count/timestamps) and (saved path block IDs). No document content is returned (C.L). Proof of Concept (POC): 1. An operator publishes Notebook A (which contains a publicly referenced document ) and keeps Notebook B password-protected or publish-disabled: a block in B backlinks to . 2. As a publish reader (or an anonymous user on a password-protected site): - with body or with . 3. The response includes (the block IDs of the referencing blocks in B) and , leaking hidden reference content that the publish password/disable settings should have withheld. Attack Chain: 1. Entry Point: A publish reader (RoleReader JWT via publish reverse proxy) or an anonymous user sends ( ) or on a password-protected publish site. 2. Document Gate: / ( ): Rejects the request if the target document is disabled/password-protected/invisible. Bypass proof: No bypass here—the attacker intentionally requests a legitimately published document, which passes this gate. This is the only content gated on this path. 3. Filter: ( 1246-1290): Clears / . Bypass proof: The condition is false only when the requested document is inaccessible—thus, / are never touched for accessible documents. The path incorrectly runs , deleting each individually—this filter path is in 7/9. 4. Sink: returns + ( line 42; ). 5. Impact: Readers gain block IDs + reference document block counts from password-protected/disabled documents. Bypass Evidence: clears / only in the branch where is inaccessible ( 1276-1286); for accessible requested documents, this branch is redundant. are unconditionally cleared from the workspace-scoped SQL query ( ), which indexes password-protected/disabled notebooks (publish configuration is not an index exclusion). Gated sibling — — (checks disabled status) + password checks remove each in inaccessible documents—demonstrating that data is treated as publish-sensitive elsewhere in the same codebase. Affected Versions: : The vulnerable code is confirmed present in the latest release tag v3.8.4 (HEAD 9f7756d), which is the v3.8.4 tag commit; there are no fixing commits between the tag and HEAD. Recommended Fix: On the / path, filter / individually by applying the same checks used in ( / per- + password check), removing referencing blocks whose containing documents are publish-disabled or password-protected—rather than only clearing the fields when the requested document itself is inaccessible. Reporter: zx (jace) — GitHub: @manus-use Scope of Impact Affected Versions: Severity: Medium (5.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: None Remediation Recommended Fix: On the / path, filter / individually by applying the same checks used in ( / per- + password check), removing referencing blocks whose containing documents are publish-disabled or password-protected—rather than only clearing the fields when the requested document itself is inaccessible. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Jupyter Notebook Publish Mode getDocInfo API Leakage of Metadata for Password-Protected Docs

More from this source