CVE-2024-0964

Remote file inclusion via vulnerable user-supplied JSON in Gradio API.

• CVSS 9.4
• CWE-22
• Input Validation and Sanitization
• Remote

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

CVE

CVE-2024-0964

CWE

CWE-22

CVSS base score

9.4

Published

2024-02-05

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Local File Inclusion (LFI)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Gradio

Fixed by upgrading

Yes

Solution

Upgrade Gradio to version 3.9.1 or later, and implement strict input validation and sanitization for user-supplied JSON values.

import gradio as gr

def function(user_input):
    with open(user_input['file_path'], 'r') as file:
        return file.read()

iface = gr.Interface(fn=function, inputs="json", outputs="text")
iface.launch()

import gradio as gr
import os

ALLOWED_DIR = "/directory"

def function(user_input):
    file_path = os.path.abspath(user_input.get('file_path', ''))
    if not file_path.startswith(os.path.abspath(ALLOWED_DIR)):
        return "Access denied."
    try:
        with open(file_path, 'r') as file:
            return file.read()
    except Exception as e:
        return f"Error reading file: {e}"

iface = gr.Interface(fn=function, inputs="json", outputs="text")
iface.launch()

{"file_path": "/etc/passwd"}

@misc{vaitp:cve20240964,
  title        = {{Remote file inclusion via vulnerable user-supplied JSON in Gradio API.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-0964},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-0964/}}
}