PT-2024-29276 · Unknown · Streamlit-Geospatial

Sylwia Budzynska + 1 · Published 2024-07-26 · Updated 2025-10-13 · CVE-2024-41120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489

Description The issue arises from the url variable in the pages/9 🔲 Vector Data Visualization.py file, which takes user input. This input is then passed to the gpd.read file method, allowing it to create requests to arbitrary destinations. This leads to a blind server-side request forgery.

Recommendations For versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489, update to a version that includes the fix from commit c4f81d9616d40c60584e36abb15300853a66e489 to resolve the issue.

Exploit

Fix

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

CVE-2024-41120

Affected Products

Streamlit-Geospatial

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41120.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial · Exploit
• https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41120 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41120 · Vendor Advisory
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py#L87 · Note
• https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py#L63 · Note
• https://twitter.com/Cezar_H_Linux/status/1977814279366771067 · Twitter Post
• https://t.me/cvedetector/1724 · Telegram Post