CVE-2024-47867

Lack of integrity check on downloaded FRP client allows malicious code injection.

• CVSS 2.1
• CWE-345
• Cryptographic
• Remote

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a **lack of integrity check** on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is downloaded, they could modify the binary without detection, as the Gradio server does not verify the file's checksum or signature. Any users utilizing the Gradio server's sharing mechanism that downloads the FRP client could be affected by this vulnerability, especially those relying on the executable binary for secure data tunneling. There is no direct workaround for this issue without upgrading. However, users can manually validate the integrity of the downloaded FRP client by implementing checksum or signature verification in their own environment to ensure the binary hasn't been tampered with.

CVE

CVE-2024-47867

CWE

CWE-345

CVSS base score

2.1

Published

2024-10-10

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Gradio

Fixed by upgrading

Yes

Solution

Upgrade to the latest version of Gradio that includes integrity checks for the FRP client, or implement checksum/signature verification manually in your environment.

import requests

def download_frp_client(url):
    response = requests.get(url)
    binary_path = 'frp_client'
    
    with open(binary_path, 'wb') as file:
        file.write(response.content)

    print("FRP client downloaded without integrity check.")

url = 'https://example.com/path/to/frp_client'
download_frp_client(url)

import hashlib
import requests
import os

def download_frp_client(url, expected_checksum):
    response = requests.get(url)
    binary_path = 'frp_client'
    
    with open(binary_path, 'wb') as file:
        file.write(response.content)

    sha256_hash = hashlib.sha256()
    with open(binary_path, 'rb') as f:
        for byte_block in iter(lambda: f.read(4096), b""):
            sha256_hash.update(byte_block)
    actual_checksum = sha256_hash.hexdigest()

    if actual_checksum != expected_checksum:
        os.remove(binary_path)
        raise ValueError("Checksum verification failed. The file may be tampered with.")

    print("FRP client downloaded and verified successfully.")

url = 'https://example.com/path/to/frp_client'
expected_checksum = 'expected_sha256_checksum_here'
download_frp_client(url, expected_checksum)

# This is a placeholder.  A real payload would be a modified FRP client binary.
# The actual payload would depend on the target system and the attacker's goals.
# This example illustrates the concept of replacing the legitimate binary.
#  It is NOT executable and is for illustrative purposes only.

# Example payload (replace with actual malicious binary)
echo "Malicious code here..." > frpc

@misc{vaitp:cve202447867,
  title        = {{Lack of integrity check on downloaded FRP client allows malicious code injection.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47867},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47867/}}
}