Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-47165— CORS origin validation accepts the null origin in Gradio

EPSS 0.17% · P38
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-47165

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CORS origin validation accepts the null origin in Gradio
Source: NVD (National Vulnerability Database)
Vulnerability Description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Gradio 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradio是Hugging Face开源的一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 Gradio存在授权问题漏洞，该漏洞源于当 Gradio 服务器在本地部署时，`localhost_aliases` 变量包含“null”作为有效来源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
gradio-appgradio < 5.0 -

II. Public POCs for CVE-2024-47165

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-47165

请登录查看更多情报信息。

Same Patch Batch · gradio-app · 2024-10-10 · 12 CVEs total

CVE-2024-47166One-level read path traversal in `/custom_component` in Gradio
CVE-2024-47872Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
CVE-2024-47167SSRF in the path parameter of /queue/join in Gradio
CVE-2024-47867Lack of integrity check on the downloaded FRP client in Gradio
CVE-2024-47168The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio
CVE-2024-47084CORS origin validation is not performed when the request has a cookie in Gradio
CVE-2024-47870Race condition in update_root_in_config may redirect user traffic in Gradio
CVE-2024-47871Insecure communication between the FRP client and server in Gradio
CVE-2024-47164The `is_in_or_equal` function may be bypassed in Gradio
CVE-2024-47869Non-constant-time comparison when comparing hashes in Gradio
CVE-2024-47868Several components’ post-process steps may allow arbitrary file leaks in Gradio

IV. Related Vulnerabilities

Same product: gradio
Same vendor: gradio-app
Same weakness: CWE-285

V. Comments for CVE-2024-47165

No comments yet

Leave a comment