CVE-2023-35394: Azure HDInsight Jupyter Notebook

CISO Take

This is a reflected cross-site scripting (CWE-79) flaw in the Jupyter Notebook interface bundled with Azure HDInsight, which Microsoft classifies as a spoofing vulnerability that requires a low-privileged attacker to lure an authenticated user into clicking a crafted link. The blast radius is limited by design — CVSS 4.6 (AV:N/AC:L/PR:L/UI:R/C:L/I:L/A:N), no listing in CISA KEV, no public exploit code, and no Nuclei scanner template — but Jupyter is a default surface in most ML training and experimentation workflows, so any working exploit chain would land squarely in active data science environments. EPSS sits at a low 0.97% absolute probability (roughly the 41st percentile among AI-tagged CVEs), meaning this is not an imminent mass-exploitation target but is plausible against a targeted, socially-engineered victim inside a shared HDInsight cluster. Microsoft has published an official fix (RL:O, RC:C confirmed) via the MSRC advisory — apply the HDInsight update during your normal patch cycle, and in the meantime remind data science teams not to click unsolicited notebook links and restrict cluster collaborator access to trusted accounts.

Sources:NVDEPSSmsrc.microsoft.com

What is the risk?

Medium severity (CVSS 4.6) with low real-world exploitation pressure: EPSS is under 1% absolute, the CVE is not in CISA KEV, no public PoC or Nuclei template exists, and exploitation requires both low-level attacker access to the environment and victim interaction (UI:R). This is a track-and-patch item rather than an emergency, but should not be deprioritized indefinitely given Jupyter's ubiquity in AI/ML workflows and the confirmed availability of an official Microsoft fix.

How does the attack unfold?

Delivery

A low-privileged attacker crafts a malicious link targeting the Azure HDInsight Jupyter Notebook interface and sends it to a victim with cluster access.

User Interaction

The authenticated victim clicks the crafted link, satisfying the required user-interaction condition for the exploit to trigger.

Exploitation

The malicious input triggers the CWE-79 flaw, executing injected script or spoofed UI content within the victim's authenticated Jupyter Notebook browser session.

Impact

The attacker achieves limited confidentiality/integrity impact — spoofing notebook UI content or harvesting low-sensitivity session data to enable further credential phishing or trust erosion in ML experiment output.

Delivery

A low-privileged attacker crafts a malicious link targeting the Azure HDInsight Jupyter Notebook interface and sends it to a victim with cluster access.

User Interaction

The authenticated victim clicks the crafted link, satisfying the required user-interaction condition for the exploit to trigger.

Exploitation

The malicious input triggers the CWE-79 flaw, executing injected script or spoofed UI content within the victim's authenticated Jupyter Notebook browser session.

Impact

The attacker achieves limited confidentiality/integrity impact — spoofing notebook UI content or harvesting low-sensitivity session data to enable further credential phishing or trust erosion in ML experiment output.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Azure HDInsight	—	—	No patch

Do you use Azure HDInsight? You're affected.

How severe is it?

CVSS 3.1

4.6 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 62% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

Apply the Microsoft-published fix for the affected Azure HDInsight Jupyter Notebook component per the MSRC advisory (an official patch is confirmed available). Restrict HDInsight cluster access to trusted, need-to-know collaborators to reduce the low-privilege attack surface (PR:L). Train data science teams to avoid clicking unsolicited or unexpected links to shared notebook URLs. Where configurable, enable browser-side XSS protections and a strict Content-Security-Policy on HDInsight web endpoints. Monitor for anomalous notebook UI behavior, unexpected redirects, or credential-entry prompts inside notebook sessions as a detection signal.

How is it classified?

Social EngineeringData LeakageFramework

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6-Resources and infrastructure for AI systems

Frequently Asked Questions

What is CVE-2023-35394?

This is a reflected cross-site scripting (CWE-79) flaw in the Jupyter Notebook interface bundled with Azure HDInsight, which Microsoft classifies as a spoofing vulnerability that requires a low-privileged attacker to lure an authenticated user into clicking a crafted link. The blast radius is limited by design — CVSS 4.6 (AV:N/AC:L/PR:L/UI:R/C:L/I:L/A:N), no listing in CISA KEV, no public exploit code, and no Nuclei scanner template — but Jupyter is a default surface in most ML training and experimentation workflows, so any working exploit chain would land squarely in active data science environments. EPSS sits at a low 0.97% absolute probability (roughly the 41st percentile among AI-tagged CVEs), meaning this is not an imminent mass-exploitation target but is plausible against a targeted, socially-engineered victim inside a shared HDInsight cluster. Microsoft has published an official fix (RL:O, RC:C confirmed) via the MSRC advisory — apply the HDInsight update during your normal patch cycle, and in the meantime remind data science teams not to click unsolicited notebook links and restrict cluster collaborator access to trusted accounts.

Is CVE-2023-35394 actively exploited?

No confirmed active exploitation of CVE-2023-35394 has been reported, but organizations should still patch proactively.

How to fix CVE-2023-35394?

Apply the Microsoft-published fix for the affected Azure HDInsight Jupyter Notebook component per the MSRC advisory (an official patch is confirmed available). Restrict HDInsight cluster access to trusted, need-to-know collaborators to reduce the low-privilege attack surface (PR:L). Train data science teams to avoid clicking unsolicited or unexpected links to shared notebook URLs. Where configurable, enable browser-side XSS protections and a strict Content-Security-Policy on HDInsight web endpoints. Monitor for anomalous notebook UI behavior, unexpected redirects, or credential-entry prompts inside notebook sessions as a detection signal.

What systems are affected by CVE-2023-35394?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, notebook/development environments, collaborative ML workspaces.

What is the CVSS score for CVE-2023-35394?

CVE-2023-35394 has a CVSS v3.1 base score of 4.6 (MEDIUM). The EPSS exploitation probability is 0.97%.

What is the AI security impact?

Affected AI Architectures

training pipelinesnotebook/development environmentscollaborative ML workspaces

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6

What are the technical details?

Original Advisory

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

Exploitation Scenario

An attacker with limited (low-privilege) access to an Azure HDInsight environment — for example a guest collaborator or someone who has obtained a crafted link to the cluster's Jupyter interface — sends that link to a data scientist working on a shared ML training pipeline. When the victim clicks the link and interacts with the resulting page, the injected script exploits the CWE-79 flaw to spoof legitimate notebook UI elements or execute within the victim's authenticated browser session. This can be used to trick the victim into disclosing credentials, approving a malicious action, or misreading spoofed experiment output — undermining trust in the notebook's displayed results and potentially enabling further credential-based compromise of the ML workspace.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.