Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.
References
| Link | Resource |
|---|---|
| https://github.com/gradio-app/gradio/security/advisories/GHSA-3c67-5hwx-f6wx | Mitigation Third Party Advisory |
Configurations
History
17 Oct 2024, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gradio-app/gradio/security/advisories/GHSA-3c67-5hwx-f6wx - Mitigation, Third Party Advisory | |
| First Time |
Gradio Project
Gradio Project gradio |
|
| CPE | cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:* | |
| CWE | NVD-CWE-Other | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.3 |
10 Oct 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-10 22:15
Updated : 2024-10-17 16:30
NVD link : CVE-2024-47084
Mitre link : CVE-2024-47084
JSON object : View
Products Affected
gradio_project
- gradio
CWE