PT-2024-29970 · Streamlit · Streamlit

Nvn1729 · Published 2024-08-12 · Updated 2024-09-16 · CVE-2024-42474

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.37.0

Description The issue is related to a path traversal vulnerability in the static file sharing feature of Streamlit. This vulnerability allows an attacker to leak the password hash of the Windows user running Streamlit when the static file sharing feature is enabled. The vulnerability only affects Windows.

Recommendations For versions prior to 1.37.0, upgrade to version 1.37.0 to resolve the issue. As a temporary workaround, consider disabling the static file sharing feature until the patch is applied. Restrict access to the static file sharing feature to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-42474

GHSA-RXFF-VR5R-8CJ5

PYSEC-2024-153

Affected Products

Streamlit

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42474.json · Exploit
• https://github.com/streamlit/streamlit/security/advisories/GHSA-rxff-vr5r-8cj5 · Vendor Advisory
• https://github.com/streamlit/streamlit/commit/3a639859cfdfba2187c81897d44a3e33825eb0a3 · Patch
• https://osv.dev/vulnerability/CVE-2024-42474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42474 · Security Note
• https://osv.dev/vulnerability/GHSA-rxff-vr5r-8cj5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-153 · Vendor Advisory
• https://github.com/streamlit/streamlit · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2024-153.yaml · Note
• https://twitter.com/oktsec/status/1824781781389721785 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823050620355412046 · Twitter Post
• https://t.me/cvedetector/2878 · Telegram Post
• https://twitter.com/Horizon3Attack/status/1826990785608208482 · Twitter Post
• https://t.me/cvenotify/94739 · Telegram Post
• https://twitter.com/CVEnew/status/1823049293680308350 · Twitter Post