Executive brief
Streamlit, a framework for building data science web applications, contains a security flaw in how it handles custom components. An attacker could potentially access sensitive files on the server hosting the application, such as logs or system configuration files. This issue is a regression or incomplete fix for a previously identified directory traversal vulnerability.
Technical details
Streamlit is vulnerable to a directory traversal attack (CWE-22) due to an incomplete fix for a previous vulnerability. The flaw exists in the component request handler and static file handler where path validation was insufficient. Specifically, the application used a common prefix check rather than a proper common path check, which could be bypassed under specific conditions to access files outside the intended directory. An attacker can exploit this by crafting malicious URLs to request files from the server's filesystem. The vulnerability was fully addressed in version 1.30.0 by switching to 'commonpath' for path validation.
Affected products
- Streamlit streamlit >= 0.63.0, < 1.30.0
Timeline
- 2022-07-28: disclosed: Initial vulnerability CVE-2022-35918 disclosed
- 2024-01-11: advisory: GHSA-8qw9-gf7w-42x5 published regarding the incomplete fix
- 2024-01-11: patched: Fixed in version 1.30.0