PT-2023-31833 · Gradio · Gradio

Nvn1729 + 1 · Published 2023-12-21 · Updated 2024-09-24 · CVE-2023-51449

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 4.11.0

Description The issue concerns a vulnerability in the /file route of Gradio, making it susceptible to file traversal attacks. An attacker could access arbitrary files on a machine running a Gradio app with a public URL if they knew the path of files to look for. This was possible through programmatic tools such as curl with the --pass-as-is flag, but not through regular URLs passed into a browser. Additionally, the /file route was vulnerable to Server-Side Request Forgery (SSRF) attacks.

Recommendations For Gradio versions prior to 4.11.0, update to version 4.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the /file route to minimize the risk of exploitation. Avoid using the /file route in Gradio apps until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-51449

GHSA-6QM2-WPXQ-7QH2

PYSEC-2023-249

Affected Products

Gradio

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51449.json · Exploit
• https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 · Patch
• https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055 · Patch
• https://osv.dev/vulnerability/GHSA-6qm2-wpxq-7qh2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-249 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51449 · Security Note
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2023-249.yaml · Note
• https://t.me/defcon_news/124006 · Telegram Post
• https://twitter.com/CVEnew/status/1738306728343568678 · Twitter Post
• https://t.me/cvenotify/66094 · Telegram Post
• https://t.me/cvenotify/95796 · Telegram Post
• https://t.me/rnetsec/20475 · Telegram Post