Publish Advisories

GHSA-4q3c-cj7g-jcwf
GHSA-j757-pf57-f8r4
GHSA-xh2x-3mrm-fwqm

advisories/github-reviewed/2024/10/GHSA-4q3c-cj7g-jcwf/GHSA-4q3c-cj7g-jcwf.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4q3c-cj7g-jcwf",
+  "modified": "2024-10-10T22:03:03Z",
+  "published": "2024-10-10T22:03:03Z",
+  "aliases": [
+    "CVE-2024-47868"
+  ],
+  "summary": "Gradio has several components with post-process steps allow arbitrary file leaks",
+  "details": "### Impact\n**What kind of vulnerability is it? Who is impacted?**\n\nThis is a **data validation vulnerability** affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input constraints. This issue could lead to sensitive files being exposed to unauthorized users, especially when combined with other vulnerabilities, such as issue TOB-GRADIO-15. The components most at risk are those that return or handle file data.\n\n### Vulnerable Components:\n1. **String to FileData:** DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton.\n2. **Complex data to FileData:** Chatbot, MultimodalTextbox.\n3. **Direct file read in preprocess:** Code.\n4. **Dictionary converted to FileData:** ParamViewer, Dataset.\n\n### Exploit Scenarios:\n1. A developer creates a Dropdown list that passes values to a DownloadButton. An attacker bypasses the allowed inputs, sends an arbitrary file path (like `/etc/passwd`), and downloads sensitive files.\n2. An attacker crafts a malicious payload in a ParamViewer component, leaking sensitive files from a server through the arbitrary file leak.\n\n### Patches\nYes, the issue has been resolved in `gradio>5.0`. Upgrading to the latest version will mitigate this vulnerability.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "gradio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-4q3c-cj7g-jcwf"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gradio-app/gradio"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-10T22:03:03Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/10/GHSA-j757-pf57-f8r4/GHSA-j757-pf57-f8r4.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j757-pf57-f8r4",
+  "modified": "2024-10-10T22:03:29Z",
+  "published": "2024-10-10T22:03:29Z",
+  "aliases": [
+    "CVE-2024-47869"
+  ],
+  "summary": "Gradio performs a non-constant-time comparison when comparing hashes",
+  "details": "### Impact  \n**What kind of vulnerability is it? Who is impacted?**\n\nThis vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys.\n\n### Patches  \nYes, please upgrade to `gradio>4.44` to mitigate this issue.\n\n### Workarounds  \n**Is there a way for users to fix or remediate the vulnerability without upgrading?**\n\nTo mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "gradio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.44.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-j757-pf57-f8r4"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gradio-app/gradio"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-208"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-10T22:03:29Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/10/GHSA-xh2x-3mrm-fwqm/GHSA-xh2x-3mrm-fwqm.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xh2x-3mrm-fwqm",
+  "modified": "2024-10-10T22:04:21Z",
+  "published": "2024-10-10T22:04:21Z",
+  "aliases": [
+    "CVE-2024-47870"
+  ],
+  "summary": "Gradio has a race condition in update_root_in_config may redirect user traffic",
+  "details": "### Impact  \n**What kind of vulnerability is it? Who is impacted?**\n\nThis vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition.\n\n### Patches  \nYes, please upgrade to `gradio>=5` to address this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "gradio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-xh2x-3mrm-fwqm"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gradio-app/gradio"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-10T22:04:21Z",
+    "nvd_published_at": null
+  }
+}