PT-2024-29274 · Pypi · Streamlit-Geospatial

Sylwia Budzynska · Published 2024-07-26 · Updated 2024-08-26 · CVE-2024-41118

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue allows for blind server-side request forgery due to the url variable taking user input, which is then used by the get wms layer method to create requests to arbitrary destinations. This occurs in the get layers function, specifically on line 47 of pages/7 📦 Web Map Service.py.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue. As a temporary workaround, consider restricting the use of the get wms layer method or validating the url variable to prevent arbitrary requests.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-41118

Affected Products

Streamlit-Geospatial

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41118.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial · Exploit
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489 · Patch
• https://osv.dev/vulnerability/CVE-2024-41118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41118 · Security Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L53 · Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L25 · Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L47 · Note
• https://t.me/cvedetector/1726 · Telegram Post