Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-47165— CORS origin validation accepts the null origin in Gradio

Quick assessment

Affected
gradio-app gradio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gradio是Hugging Face开源的一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 Gradio存在授权问题漏洞，该漏洞源于当 Gradio 服务器在本地部署时， 变量包含“null”作为有效来源。

AI Predicted 6.1 Difficulty: Easy EPSS 0.30% · P20

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-47165

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CORS origin validation accepts the null origin in Gradio
Source: CVE Program / CVE List V5
Vulnerability Description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Gradio 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradio是Hugging Face开源的一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 Gradio存在授权问题漏洞，该漏洞源于当 Gradio 服务器在本地部署时，`localhost_aliases` 变量包含“null”作为有效来源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
gradio-app gradio < 5.0 -

II. Public POCs for CVE-2024-47165

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-47165

请登录查看更多情报信息。

Same Patch Batch · gradio-app · 2024-10-10 · 12 CVEs total

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio
CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
CVE-2024-47167 SSRF in the path parameter of /queue/join in Gradio
CVE-2024-47867 Lack of integrity check on the downloaded FRP client in Gradio
CVE-2024-47168 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio
CVE-2024-47870 Race condition in update_root_in_config may redirect user traffic in Gradio
CVE-2024-47871 Insecure communication between the FRP client and server in Gradio
CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio
CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio
CVE-2024-47868 Several components’ post-process steps may allow arbitrary file leaks in Gradio

IV. Related Vulnerabilities

Same product: gradio
Same vendor: gradio-app
Same weakness: CWE-285

V. Comments for CVE-2024-47165

No comments yet

Leave a comment