CVE-2022-35918

Streamlit directory traversal vulnerability in custom components

• CVSS 6.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue.

CVE

CVE-2022-35918

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

6.5

Published

2022-08-01

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to Streamlit version 1.11.1 or higher.

import os

def file_access(file_path):
    """Vulnerable function that demonstrates the security issue."""
    with open(file_path, 'r') as file:
        return file.read()

content = file_access("/path/to/file_access/../../etc/passwd")
print(content)

import os
from urllib.parse import unquote

def file_access(file_path):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents path traversal
    base_dir = "/path/to/allowed/directory"
    normalized_path = os.path.normpath(unquote(file_path))
    
    if not normalized_path.startswith(base_dir):
        raise ValueError("Access to the requested file is not allowed.")
    
    with open(normalized_path, 'r') as file:
        return file.read()

try:
    content = file_access("/path/to/file_access/../../etc/passwd")
    print(content)
except ValueError as e:
    print(e)

@misc{vaitp:cve202235918,
  title        = {{Streamlit directory traversal vulnerability in custom components}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-35918},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-35918/}}
}