cve-2024-1561
Vulnerability from cvelistv5
Published
2024-04-16 00:00
Modified
2024-08-01 18:40
Severity
Summary
Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
References
Impacted products
| Vendor | Product |
|---|---|
| gradio-app | gradio-app/gradio |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"
],
"defaultStatus": "unknown",
"product": "gradio",
"vendor": "gradio_project",
"versions": [
{
"status": "affected",
"version": "4.12.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-13T19:06:47.462340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:01:14.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:40:21.441Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.gradio.app/changelog#4-13-0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "gradio-app/gradio",
"vendor": "gradio-app",
"versions": [
{
"lessThan": "4.13.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-29",
"description": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-16T00:00:15.906Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai"
},
"references": [
{
"url": "https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338"
},
{
"url": "https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2"
},
{
"url": "https://www.gradio.app/changelog#4-13-0"
}
],
"source": {
"advisory": "4acf584e-2fe8-490e-878d-2d9bf2698338",
"discovery": "EXTERNAL"
},
"title": "Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio"
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"cveId": "CVE-2024-1561",
"datePublished": "2024-04-16T00:00:15.906Z",
"dateReserved": "2024-02-15T19:12:58.336Z",
"dateUpdated": "2024-08-01T18:40:21.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-1561\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2024-04-16T00:15:08.887\",\"lastModified\":\"2024-05-10T15:15:07.133\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema en gradio-app/gradio, donde el endpoint `/component_server` permite incorrectamente la invocaci\u00f3n de cualquier m\u00e9todo en una clase `Component` con argumentos controlados por el atacante. Espec\u00edficamente, al explotar el m\u00e9todo `move_resource_to_block_cache()` de la clase `Block`, un atacante puede copiar cualquier archivo en el sistema de archivos a un directorio temporal y posteriormente recuperarlo. Esta vulnerabilidad permite el acceso de lectura de archivos locales no autorizados, lo que representa un riesgo significativo, especialmente cuando la aplicaci\u00f3n est\u00e1 expuesta a Internet a trav\u00e9s de \\\"launch(share=True)\\\", lo que permite a atacantes remotos leer archivos en la m\u00e1quina host. Adem\u00e1s, las aplicaciones de gradio alojadas en `huggingface.co` tambi\u00e9n se ven afectadas, lo que podr\u00eda provocar la exposici\u00f3n de informaci\u00f3n confidencial, como claves API y credenciales almacenadas en variables de entorno.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@huntr.dev\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-29\"}]}],\"references\":[{\"url\":\"https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2\",\"source\":\"security@huntr.dev\"},{\"url\":\"https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338\",\"source\":\"security@huntr.dev\"},{\"url\":\"https://www.gradio.app/changelog#4-13-0\",\"source\":\"security@huntr.dev\"}]}}"
}
}
Loading...