CVE-2024-47869

Timing attack in Gradio allows unauthorized access to the analytics dashboard.

• CVSS 2.3
• CWE-203
• Cryptographic
• Remote

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.

CVE

CVE-2024-47869

CWE

CWE-203

CVSS base score

2.3

Published

2024-10-10

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Gradio

Fixed by upgrading

Yes

Solution

Upgrade to `gradio>4.44` and implement constant-time comparison for hash checks.

import time

def analytics_dashboard(user_hash, stored_hash):
    time.sleep(0.1)
    if user_hash == stored_hash:
        return "Access Granted"
    else:
        return "Access Denied"

stored_hash = b'secret_hash'
user_hash = b'user_provided_hash'
print(analytics_dashboard(user_hash, stored_hash))

import hmac
import time

def constant_time_compare(val1, val2):
    if len(val1) != len(val2):
        return False
    result = 0
    for x, y in zip(val1, val2):
        result |= x ^ y
    return result == 0

def analytics_dashboard(user_hash, stored_hash):
    time.sleep(0.1)
    if constant_time_compare(user_hash, stored_hash):
        return "Access Granted"
    else:
        return "Access Denied"

stored_hash = b'secret_hash'
user_hash = b'user_provided_hash'
print(analytics_dashboard(user_hash, stored_hash))

# Example payload for timing attack
import time
import requests

def timing_attack(base_url, known_hash):
    for i in range(256):  # Iterate over all possible byte values
        test_hash = known_hash[:-1] + bytes([i])  # Modify the last byte
        start_time = time.time()
        response = requests.post(base_url, data={'user_hash': test_hash})
        elapsed_time = time.time() - start_time
        print(f'Testing hash: {test_hash.hex()} - Response time: {elapsed_time:.4f} seconds')

# Example usage
base_url = 'http://example.com/analytics_dashboard'
known_hash = b'\x00\x00\x00\x00'  # Starting point for the hash
timing_attack(base_url, known_hash)

@misc{vaitp:cve202447869,
  title        = {{Timing attack in Gradio allows unauthorized access to the analytics dashboard.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47869},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47869/}}
}