streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.py

The SSRF vulnerability in streamlit-geospatial arises from the improper handling of user-supplied URLs within the pages/7📦WebMapService.py file. Specifically, the url variable, derived directly from user input, is passed to the getwmslayer method without adequate validation. This allows an attacker to manipulate the URL to point to internal services or external resources that the application should not be accessing. A successful exploitation could lead to the exposure of sensitive internal data, such as configuration files or database credentials, if the application interacts with internal services. Furthermore, an attacker could potentially use the SSRF vulnerability to scan internal networks or launch attacks against other systems within the organization’s infrastructure. The blind nature of the SSRF means the attacker doesn't directly see the response, but can infer information based on the application's behavior.

Organizations deploying streamlit-geospatial in production environments, particularly those with sensitive internal services or data, are at risk. Shared hosting environments where multiple Streamlit applications share the same server are also at increased risk, as a vulnerability in one application could potentially be exploited to access resources belonging to other applications.

• python: Monitor for requests originating from the Streamlit application to unusual or internal IP addresses. Use Python's logging module to log outbound requests and analyze for suspicious patterns.

import logging
import requests

logging.basicConfig(level=logging.INFO)

def make_request(url):
    try:
        response = requests.get(url)
        logging.info(f'Request to {url} successful. Status code: {response.status_code}')
        return response.text
    except requests.exceptions.RequestException as e:
        logging.error(f'Request to {url} failed: {e}')
        return None

# Example usage (replace with your actual Streamlit code)
url = input("Enter URL: ")
make_request(url)

• generic web: Examine access and error logs for requests to internal IP addresses or unusual domains originating from the Streamlit application's server. Look for patterns indicative of SSRF attempts. • generic web: Check response headers for unexpected content or redirects that might indicate SSRF exploitation.

1. 2024-07-26Disclosure

   disclosure

1. Reserviert2024-07-15
2. Veröffentlicht2024-07-26
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-41118 is to upgrade to version c4f81d9616d40c60584e36abb15300853a66e489 or later. This version includes a fix that properly validates user-supplied URLs, preventing the SSRF vulnerability. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests and block those targeting internal or unauthorized external resources. Restrict network access for the Streamlit application to only the necessary external services. Implement strict input validation on all user-supplied URLs to ensure they conform to expected formats and destinations. Regularly review and update the streamlit-geospatial library to benefit from the latest security patches.