CVE-2023-51449

MEDIUMNuclei

Make the `/file` secure against file traversal attacks

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-51449 has a selected CVSS score of 5.6 (medium); EIP currently links 1 Nuclei template.

Description

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

gradio

Browse gradio-app / gradio
CVE List< 4.11.0affected

gradio

Browse PyPI / gradio
GitHub AdvisoryBefore 4.11.0 · Fixed in 4.11.0affected

Nuclei templates

1
ProjectDiscoveryHIGHGradio Hugging Face - Local File InclusionCVSS 7.5

Gradio LFI when auth is not enabled, affects versions 4.0 - 4.10, also works against Gradio < 3.33

Impact

Unauthenticated attackers can read arbitrary files from the server when authentication is not enabled, potentially exposing sensitive configuration files and credentials.

Remediation

Upgrade Gradio to version 3.33 or later (for Gradio < 3.x) or to version 4.11 or later (for Gradio 4.x).

WeaknessesCWE-22
Authorsnvn1729
Template tagscvecve2023lfigradiounauthintrusivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
Shodan: html:"__gradio_mode__"
FOFA: body="__gradio_mode__"
https://www.horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/ https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2 https://nvd.nist.gov/vuln/detail/CVE-2023-51449

Source: ProjectDiscovery

References

6