Junglewise Threat Intelligence

Streamlit path traversal in custom components static file handler

Severity: medium · CVSS 5.3 · Published 2024-01-12

Executive brief

Streamlit, a framework for building data science web applications, contains a security flaw in how it handles custom components. An attacker could potentially access sensitive files on the server hosting the application, such as logs or system configuration files. This issue is a regression or incomplete fix for a previously identified directory traversal vulnerability.

Technical details

Streamlit is vulnerable to a directory traversal attack (CWE-22) due to an incomplete fix for a previous vulnerability. The flaw exists in the component request handler and static file handler where path validation was insufficient. Specifically, the application used a common prefix check rather than a proper common path check, which could be bypassed under specific conditions to access files outside the intended directory. An attacker can exploit this by crafting malicious URLs to request files from the server's filesystem. The vulnerability was fully addressed in version 1.30.0 by switching to 'commonpath' for path validation.

Affected products

  • Streamlit streamlit >= 0.63.0, < 1.30.0

Timeline

  • 2022-07-28: disclosed: Initial vulnerability CVE-2022-35918 disclosed
  • 2024-01-11: advisory: GHSA-8qw9-gf7w-42x5 published regarding the incomplete fix
  • 2024-01-11: patched: Fixed in version 1.30.0

References

Related threats