PT-2024-29271 · Unknown · Streamlit-Geospatial

Sylwia Budzynska · Published 2024-07-26 · Updated 2024-08-26 · CVE-2024-41115

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue arises from the palette variable, which takes user input in the pages/1 📷 Timelapse.py file. This input is later used in the eval() function, leading to remote code execution.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue. As a temporary workaround, consider restricting user input to the palette variable or avoiding the use of the eval() function with user-supplied input.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-41115

Affected Products

Streamlit-Geospatial

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41115.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial · Exploit
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489 · Patch
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L488 · Patch
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L493 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41115 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41115 · Vendor Advisory
• https://t.me/cvedetector/1725 · Telegram Post