SB2024101078 - Multiple vulnerabilities in Gradio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024101078

SB2024101078 - Multiple vulnerabilities in Gradio

Published: October 10, 2024 Updated: April 28, 2026

Security Bulletin ID SB2024101078
Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 11% Medium 67% Low 22%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Download of code without integrity check (CVE-ID: CVE-2024-47867)

The vulnerability allows a remote attacker to introduce malicious code.

The vulnerability exists due to improper integrity verification in the FRP client download mechanism when downloading the FRP client from a remote URL. A remote attacker can modify the downloaded binary to introduce malicious code.

Exploitation requires access to the remote URL from which the FRP client is downloaded.


2) Input validation error (CVE-ID: CVE-2024-47868)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in several Gradio components' post-processing and preprocessing logic when handling crafted component input that is converted to or read as file data. A remote attacker can send a specially crafted request with an arbitrary file path to disclose sensitive information.

The issue affects components that return or handle file data, including DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton, Chatbot, MultimodalTextbox, Code, ParamViewer, and Dataset.


3) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass intended input constraints.

The vulnerability exists due to improper input validation in the Dropdown component pre-processing step when handling custom requests with arbitrary values. A remote attacker can send a specially crafted request to bypass intended input constraints.

This issue occurs even when the allow_custom_value parameter is set to false.


4) Race condition (CVE-ID: CVE-2024-47870)

The vulnerability allows a remote attacker to redirect user traffic to a malicious server.

The vulnerability exists due to a race condition in update_root_in_config when updating the root URL used by the frontend to communicate with the backend. A remote attacker can modify the root URL to redirect user traffic to a malicious server.

This may enable interception of sensitive data such as authentication credentials or uploaded files.


5) Cleartext transmission of sensitive information (CVE-ID: CVE-2024-47871)

The vulnerability allows a remote attacker to disclose sensitive information and modify transmitted data.

The vulnerability exists due to missing encryption in FRP client-server communication when using the share=True option. A remote attacker can intercept network traffic between the FRP client and server to disclose sensitive information and modify transmitted data.

This issue affects publicly shared Gradio demos exposed over the internet through the share=True feature.


6) Cross-site scripting (CVE-ID: CVE-2024-47872)

The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in file upload handling and display of uploaded files when processing uploaded HTML, JavaScript, or SVG files. A remote user can upload a crafted file to execute arbitrary script in a victim's browser.

User interaction is required when another user downloads or views the uploaded file.


7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-47167)

The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper control of outbound requests in the async_save_url_to_cache function within the /queue/join endpoint when processing a user-controlled URL path parameter. A remote attacker can supply a crafted URL to perform server-side request forgery.

Exploitation can target internal servers or services, and fetched content is stored locally. Applications using components that fetch URLs, such as the Video component, are affected.


8) Improper access control (CVE-ID: CVE-2024-47165)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in CORS origin validation when handling requests from a null origin. A remote attacker can send unauthorized cross-origin requests from a sandboxed iframe or other null-origin source to disclose sensitive information.

This affects locally deployed instances and may expose user authentication tokens or uploaded files.


9) Path traversal (CVE-ID: CVE-2024-47164)

The vulnerability allows a remote attacker to access restricted files.

The vulnerability exists due to path traversal in the is_in_or_equal function when handling file paths containing parent directory sequences. A remote attacker can supply a specially crafted path to access restricted files.

This primarily affects deployments relying on blocklist or directory access validation, particularly when handling file uploads.


Remediation

Install update from vendor's website.

References