Loading HuntDB...

CVE-2024-47870

UNKNOWN
Published 2024-10-10T22:15:05.594Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2024-47870. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Gradio has a race condition in update_root_in_config may redirect user traffic

GHSA-xh2x-3mrm-fwqm

Advisory Details

### Impact **What kind of vulnerability is it? Who is impacted?** This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. ### Patches Yes, please upgrade to `gradio>=5` to address this issue.

Affected Packages

PyPI gradio
ECOSYSTEM: ≥0 <5.0.0

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Advisory provided by GitHub Security Advisory Database. Published: October 10, 2024, Modified: January 21, 2025

References

Published: 2024-10-10T22:15:05.594Z
Last Modified: 2024-10-11T15:17:49.588Z
Copied to clipboard!