PT-2024-29270 · Unknown · Streamlit-Geospatial

Sylwia Budzynska · Published 2024-07-26 · Updated 2024-08-26 · CVE-2024-41114

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue arises from the palette variable, which takes user input on line 430 in pages/1 📷 Timelapse.py. This input is later used in the eval() function on line 435, leading to remote code execution.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue. As a temporary workaround, consider restricting the use of the eval() function or sanitizing the palette variable to prevent malicious input.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-41114

Affected Products

Streamlit-Geospatial

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41114.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial · Exploit
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489 · Patch
• https://osv.dev/vulnerability/CVE-2024-41114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41114 · Security Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L435 · Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L430 · Note
• https://t.me/cvedetector/1730 · Telegram Post
• https://t.me/cvenotify/87626 · Telegram Post