PT-2021-23963 · Gradio · Gradio

Haby0 · Published 2021-12-15 · Updated 2022-01-21 · CVE-2021-43831

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 2.5.0

Description: The issue affects users who create and publicly share Gradio interfaces. File paths are not restricted, allowing users who receive a Gradio link to access any files on the host computer if they know the file names or file paths, limited only by the host operating system. The files are opened in read-only mode. There is no evidence that this issue was ever exploited.

Recommendations: For Gradio versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider avoiding the sharing of Gradio interfaces until the update is applied. Restrict access to sensitive files on the host computer to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-43831

GHSA-RHQ2-3VR9-6MCR

PYSEC-2021-873

Affected Products

Gradio

References · 8

• 🔥 https://github.com/gradio-app/gradio/security/advisories/GHSA-rhq2-3vr9-6mcr · Exploit
• https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781 · Patch
• https://osv.dev/vulnerability/CVE-2021-43831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43831 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-873 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhq2-3vr9-6mcr · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2021-873.yaml · Note