PT-2024-32862 · Gradio · Gradio

Ahpaleus + 1 · Published 2024-10-10 · Updated 2024-10-17 · CVE-2024-47870

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5

Description This issue involves a race condition in the update root in config function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server, potentially intercepting sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet.

Recommendations To address this issue, upgrade to gradio>=5. There are no known workarounds for this issue. As a temporary workaround, consider restricting access to the update root in config function until a patch is applied.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2024-47870

GHSA-XH2X-3MRM-FWQM

PYSEC-2024-218

Affected Products

Gradio

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47870.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47870 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-218 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xh2x-3mrm-fwqm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47870 · Security Note
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/security/advisories/GHSA-xh2x-3mrm-fwqm · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-218.yaml · Note
• https://t.me/cvenotify/97856 · Telegram Post
• https://t.me/cvedetector/7648 · Telegram Post
• https://twitter.com/CVEnew/status/1844507016653570177 · Twitter Post