SB2024101079 - Multiple vulnerabilities in Gradio

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2024-47869)

The vulnerability allows a remote attacker to gain unauthorized access to the analytics dashboard.

The vulnerability exists due to observable timing discrepancies in hash comparison in the analytics_dashboard function when comparing attacker-supplied keys against the expected hash. A remote attacker can send repeated requests and measure response times to infer the correct hash byte-by-byte to gain unauthorized access to the analytics dashboard.

2) Path traversal (CVE-ID: CVE-2024-47166)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the /custom_component endpoint when processing a manipulated file path in a request. A remote attacker can send a specially crafted request to disclose sensitive information.

The traversal is limited to a single directory level and can expose source code from custom Gradio components.

3) Improper access control (CVE-ID: CVE-2024-47168)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the /monitoring endpoint when monitoring is expected to be disabled via the enable_monitoring flag. A remote attacker can send a direct request to the endpoint to disclose sensitive information.

Sensitive application analytics may be exposed even when monitoring is configured as disabled.

4) Improper access control (CVE-ID: CVE-2024-47084)

The vulnerability allows a remote user to make unauthorized requests and disclose sensitive information.

The vulnerability exists due to improper access control in CustomCORSMiddleware when handling cross-origin requests with a cookie present. A remote user can host a malicious website to make unauthorized requests and disclose sensitive information.

This impacts locally deployed instances that use basic authentication, and exploitation requires the victim to visit a malicious website while logged in.

Remediation

Install update from vendor's website.

References

• https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4
• https://github.com/gradio-app/gradio/security/advisories/GHSA-37qc-qgx6-9xjv
• https://github.com/gradio-app/gradio/security/advisories/GHSA-hm3c-93pg-4cxw
• https://github.com/gradio-app/gradio/security/advisories/GHSA-3c67-5hwx-f6wx