CVE-2024-41114
📋 TL;DR
This vulnerability in streamlit-geospatial allows remote code execution via unsafe eval() usage with user-controlled input. Attackers can execute arbitrary code on systems running vulnerable versions. Anyone using streamlit-geospatial versions before the fix is affected.
💻 Affected Systems
- streamlit-geospatial
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to data exfiltration, system takeover, or deployment of ransomware/cryptominers.
If Mitigated
No impact if proper input validation and sanitization are implemented or eval() is avoided.
🎯 Exploit Status
Exploitation is straightforward as it involves passing malicious input to the palette parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit c4f81d9616d40c60584e36abb15300853a66e489
Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/
Restart Required: Yes
Instructions:
1. Update to latest version from GitHub repository. 2. Replace eval() with safe alternatives like ast.literal_eval() or predefined palette mappings. 3. Restart the streamlit application.
🔧 Temporary Workarounds
Disable Timelapse Page
allRemove or disable access to the vulnerable Timelapse.py page
mv pages/1_📷_Timelapse.py pages/1_📷_Timelapse.py.disabled
Input Validation
allAdd strict input validation to only allow known safe palette values
Modify line 430 to validate palette against a whitelist of allowed values
🧯 If You Can't Patch
- Implement network segmentation to isolate the vulnerable application
- Deploy web application firewall (WAF) with RCE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if your code contains eval() on line 435 of pages/1_📷_Timelapse.py with user input from line 430Check Version:
git log --oneline -1Verify Fix Applied:
Verify commit c4f81d9616d40c60584e36abb15300853a66e489 is applied and eval() is replaced with safe alternatives📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from streamlit, unexpected system commands in logs
Network Indicators:
- Outbound connections from streamlit to unexpected destinations
SIEM Query:
process_name:python AND command_line:*eval* AND parent_process:streamlit🔗 References
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L430
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L435
- https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
- https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L430
- https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L435
- https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
- https://securitylab.github.com/advisories/GHSL-2024-100_GHSL-2024-108_streamlit-geospatial/
