PT-2024-29273 · Unknown · Streamlit-Geospatial

Sylwia Budzynska · Published 2024-07-26 · Updated 2024-08-26 · CVE-2024-41117

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue concerns the use of user input in the vis params variable, which is later executed by the eval() function, leading to remote code execution. This occurs in the pages/10 🌍 Earth Engine Datasets.py file.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue. As a temporary workaround, consider restricting the use of the eval() function with user-input data until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-41117

Affected Products

Streamlit-Geospatial

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41117.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial · Exploit
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489 · Patch
• https://osv.dev/vulnerability/CVE-2024-41117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41117 · Security Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/10_%F0%9F%8C%8D_Earth_Engine_Datasets.py#L126 · Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/10_%F0%9F%8C%8D_Earth_Engine_Datasets.py#L115 · Note
• https://t.me/cvedetector/1729 · Telegram Post