Exposed Jupyter servers hand attackers code execution

Aqua Nautilus found roughly 15,000 internet-reachable Jupyter servers, about 1% of which allowed code execution. Attackers used them to relay sports streams via ffmpeg. The report also cites CVE-2024-35178, an NTLM hash leak in Jupyter Server on Windows fixed in 2.14.1.

• About 15,000 Jupyter servers are internet-reachable, ~1% allowed code execution
• Attackers ran ffmpeg to relay sports streams
• CVE-2024-35178 leaks NTLM hashes via UNC paths, fixed in 2.14.1
• Recommended: token auth, a proxy, and isolated namespaces without host mounts