Gradio Server Vulnerability Affects Basic Authentication
CVE-2024-47084

8.3HIGH

Key Information:

Vendor

Gradio-app

Status
Gradio
Vendor
CVE Published:
10 October 2024

What is CVE-2024-47084?

A vulnerability related to CORS origin validation in the Gradio open-source Python package has been identified. The Gradio server does not adequately validate the origin of requests when cookies are present. This flaw permits an attacker-controlled website to make unauthorized requests to a locally hosted Gradio server. If a user is logged into Gradio and visits a malicious site, attackers could potentially upload files, steal authentication tokens, and access sensitive user data. Users running Gradio locally, especially those using basic authentication, are particularly at risk. It is recommended to upgrade to Gradio version 4.44 or higher to mitigate this issue. Additionally, users can implement stricter CORS origin validation by adjusting the CustomCORSMiddleware class in their server code to prevent exploitation.

Affected Version(s)

gradio < 4.44

References

https://github.com/gradio-app/gradio/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-47084 : Gradio Server Vulnerability Affects Basic Authentication