PT-2023-21169 · Streamlit · Streamlit

Published 2023-03-16 · Updated 2024-08-13 · CVE-2023-27494

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Streamlit versions 0.63.0 through 0.80.0

Description The issue is a cross-site scripting (XSS) vulnerability that affects users of hosted Streamlit apps. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app, tricking the user into visiting it. If successful, the server would render the malicious javascript payload as-is, leading to XSS.

Recommendations For versions 0.63.0 through 0.80.0, update to version 0.81.0 or later to patch the vulnerability. As a temporary workaround, consider restricting access to hosted Streamlit apps to minimize the risk of exploitation. Avoid using malicious URLs with Javascript payloads in Streamlit apps until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-27494

GHSA-9C6G-QPGJ-RVXW

PYSEC-2023-50

Affected Products

Streamlit

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27494.json · Exploit
• https://github.com/streamlit/streamlit/commit/afcf880c60e5d7538936cc2d9721b9e1bc02b075 · Patch
• https://github.com/streamlit/streamlit/security/advisories/GHSA-9c6g-qpgj-rvxw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c6g-qpgj-rvxw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27494 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-50 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27494 · Security Note
• https://github.com/streamlit/streamlit · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2023-50.yaml · Note
• https://t.me/cvenotify/90258 · Telegram Post