CVE-2024-42474: Streamlit Path Traversal Security Vulnerability on Windows
1. Impacted Products Streamilt Open Source versions before 1.37.0.
2. Introduction Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
3. Path Traversal Vulnerability 3.1 Description On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of 5.9 3.2 Scenarios and attack vector(s) Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. 3.3 Resolution The vulnerability has been fixed in all Streamlit versions released since Jul 25, 2024. We recommend all users upgrade to Version 1.37.0.
4. Contact Please contact security@snowflake.com if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Other sources
Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerability when the static file sharing feature is enabled. An attacker could utilize the vulnerability to leak the password hash of the Windows user running Streamlit. The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42474?
CVE-2024-42474 has been classified as a moderate severity vulnerability affecting Streamlit versions before 1.37.0.
How do I fix CVE-2024-42474?
To fix CVE-2024-42474, upgrade Streamlit to version 1.37.0 or later.
Which versions of Streamlit are affected by CVE-2024-42474?
CVE-2024-42474 affects all versions of Streamlit prior to 1.37.0.
What type of vulnerability is CVE-2024-42474?
CVE-2024-42474 is a security vulnerability related to the static file sharing feature in Streamlit.
Is CVE-2024-42474 fixed in the latest version of Streamlit?
Yes, CVE-2024-42474 has been fixed in Streamlit version 1.37.0.