gradio-app/gradio · Security
Gradio has a race condition in update_root_in_config may redirect user traffic
- GHSA ID
- GHSA-xh2x-3mrm-fwqm
- CVE ID
- CVE-2024-47870
- Severity
- high
- Published
- Updated
- CVSS
- 7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- CVSS v3
- 7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- CVSS v4
- 8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Description
Impact
What kind of vulnerability is it? Who is impacted?
This vulnerability involves a race condition in the update_root_in_config function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition.
Patches
Yes, please upgrade to gradio>=5 to address this issue.
CWEs
- CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')