PT-2024-32448 · Gradio · Gradio
Ahpaleus
+1
·
Published
2024-10-10
·
Updated
2024-10-17
·
CVE-2024-47165
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Gradio versions prior to 5.0
Description
This issue relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the
localhost aliases variable includes "null" as a valid origin, allowing attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin. This could lead to data theft, such as user authentication tokens or uploaded files, especially impacting users running Gradio locally who use basic authentication.Recommendations
To address this issue, upgrade to
gradio>=5.0.
As a temporary workaround, manually modify the localhost aliases list in the local Gradio deployment to exclude "null" as a valid origin, mitigating the potential for exploitation.Exploit
Fix
Improper Authorization
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gradio