Weaponizing Streamlit: Cloud Account Takeover Through File Upload Exploitation

No ratings

Presented at BSides Toronto 2025 by

Snir Aviv

Yuval Moravchick

File upload vulnerabilities in cloud-native environments can have catastrophic consequences far beyond their perceived low severity. This session exposes a major flaw in Streamlit’s st.file_uploader widget, demonstrating a real-world exploit chain from bypassing client-side checks to gaining persistent access, manipulating cloud roles, and tampering with live data dashboards. Learn why trusting frontend logic is dangerous and how open-source misconfigurations become high-impact attack surfaces.