DEV Community

kozhevniko
kozhevniko

Posted on

Jupyter Notebooks on the Open Internet: 408,240 Body Matches

#zoomeye #attacksurface #exposure

Jupyter Notebooks on the Open Internet: 408,240 Body Matches

Jupyter is infrastructure that teams deploy and then rarely revisit. ZoomEye indexes the service side of those deployments, and the observed population is large enough that the exposure question is worth stating with the measurement attached rather than with an adjective.

What was measured

ZoomEye was queried for Jupyter pages. The query http.body="Jupyter" returned 408,240 matches. The measurement was taken on 2026-10-04 (UTC) with the SDK sub_type set to all, which covers device and domain assets in one scope. A second, narrower fingerprint was collected. The query title="Jupyter" returned 149,922 matches, which shows how much a result depends on the field chosen rather than on the asset population itself. The number is an index count of matching assets, not a count of vulnerable or misconfigured systems.

Why the number is not the finding

A port answer or a product fingerprint tells you that something is speaking the protocol. It does not tell you whether authentication is enabled, whether the instance is a lab that will be deleted tomorrow, or whether the service is reachable from the public internet by design.
A notebook server is an execution environment with a browser front end. A body-content query returns 408,240 matches, and the operational question is how many of them accept a request without a token.

What the exposure actually means

The practical reading of a count this size is that the service is common, that scanning tools find it cheaply, and that the security of each instance depends on configuration decisions made by the operator rather than on the protocol. Attackers do not need to enumerate the whole population; they need the subset that answers without credentials, and that subset is discovered by probing rather than by counting.
Jupyter has supported tokens and password authentication for years, and the classic failure is a server started with authentication disabled or bound to all interfaces during debugging and never stopped. Execution in a notebook reaches the host through the functions the kernel can call, which makes an unauthenticated notebook server equivalent to remote code execution.

How to use this measurement

The verification step is to request the server root without a token and see whether a kernel list is returned. The configuration step is to keep the server on localhost behind an SSH tunnel, or to place authentication in front of it. Version control history, environment variables and the notebook files themselves frequently contain credentials that the server will display to whoever asks.
ZoomEye is useful here because it reports what the internet can see rather than what the configuration was intended to be. That gap, between intent and observation, is where this class of exposure lives.

References

Top comments (0)