PT-2024-32398 · Gradio · Gradio
Ahpaleus
+1
·
Published
2024-10-10
·
Updated
2025-01-21
·
CVE-2024-47084
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Gradio versions prior to 4.44
Description
This issue is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication.
Recommendations
To address this issue, users are advised to upgrade to gradio>=4.44.
As a temporary workaround, users can manually enforce stricter CORS origin validation by modifying the CustomCORSMiddleware class in their local Gradio server code, specifically bypassing the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.
Exploit
Fix
Improper Authorization
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gradio