CVE-2024-47165 Information

Description

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally the localhost_aliases variable includes ull\ as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin potentially leading to data theft such as user authentication tokens or uploaded files. This impacts users running Gradio locally especially those using basic authentication. Users are advised to upgrade to gradio>=5.0 to address this issue. As a workaround users can manually modify the localhost_aliases list in their local Gradio deployment to exclude ull\ as a valid origin. By removing this value the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin mitigating the potential for exploitation.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Reference

https://github.com/gradio-app/gradio/security/advisories/GHSA-89v2-pqfv-c5r9

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

5.4