CVE-2024-1728

Nuclei

Local File Inclusion in gradio-app/gradio

Title source: CVE List
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2024-1728.

Description

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 15, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

gradio-app/gradio

Browse gradio-app / gradio-app/gradio
CVE ListBefore 4.19.2affected

gradio

Browse gradio_project / gradio

Default status: unknown

CVE List-affected

gradio

Browse PyPI / gradio
GitHub AdvisoryBefore 4.19.2 · Fixed in 4.19.2affected

Nuclei templates

1
ProjectDiscoveryHIGHGradio > 4.19.1 UploadButton - Path TraversalCVSS 7.5

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.

Impact

Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.

Remediation

Update to version 4.19.2.

WeaknessesCWE-22
Authorsisacaya
Template tagscvecve2024lfigradiointrusivevuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: html:"__gradio_mode__"
https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7 https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a https://nvd.nist.gov/vuln/detail/CVE-2024-1728

Source: ProjectDiscovery

References

5