CVE-2024-47164

Directory traversal vulnerability in Gradio's `is_in_or_equal` function.

• CVSS 2.3
• CWE-22
• Input Validation and Sanitization
• Remote

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the **bypass of directory traversal checks** within the `is_in_or_equal` function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that manipulate file paths using `..` (parent directory) sequences. Attackers could potentially access restricted files if they are able to exploit this flaw, although the difficulty is high. This primarily impacts users relying on Gradio’s blocklist or directory access validation, particularly when handling file uploads. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually sanitize and normalize file paths in their Gradio deployment before passing them to the `is_in_or_equal` function. Ensuring that all file paths are properly resolved and absolute can help mitigate the bypass vulnerabilities caused by the improper handling of `..` sequences or malformed paths.

CVE

CVE-2024-47164

CWE

CWE-22

CVSS base score

2.3

Published

2024-10-10

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Gradio

Fixed by upgrading

Yes

Solution

Upgrade to `gradio>=5.0`.

import os

def read_file(filename):
    """Read file - VULNERABLE to path traversal"""
    try:
        # VULNERABILITY: No path validation
        # Attacker can use ../../../etc/passwd
        with open(filename, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example exploitation:
# read_file("../../../etc/passwd")

import os
from pathlib import Path

def read_file_secure(filename):
    """Securely read file with path validation"""
    try:
        # Input validation
        if not filename or '..' in filename:
            return "Error: Invalid filename"
        
        # Restrict to safe directory
        safe_dir = Path("/safe_files")
        file_path = (safe_dir / filename).resolve()
        
        # Ensure path is within safe directory
        if not str(file_path).startswith(str(safe_dir)):
            return "Error: Path traversal detected"
        
        with open(file_path, 'r') as f:
            return f.read()
    except Exception:
        return "Error: Access denied"

"../restricted_file.txt"

@misc{vaitp:cve202447164,
  title        = {{Directory traversal vulnerability in Gradio's `is_in_or_equal` function.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47164},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47164/}}
}