CVE-2024-47870

Race condition in Gradio allows URL modification, risking user data interception.

• CVSS 7.1
• CWE-362
• Race Conditions
• Remote

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.

CVE

CVE-2024-47870

CWE

CWE-362

CVSS base score

7.1

Published

2024-10-10

OWASP

A10 Insufficient Logging & Monitoring

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Race Conditions

Subcategory

Time-of-Check to Time-of-Use

Accessibility scope

Remote

Impact

Data Theft

Affected component

Gradio

Fixed by upgrading

Yes

Solution

Upgrade to `gradio>=5`.

import gradio as gr
import threading

# Global variable to hold the root URL
root_url = "http://localhost:7860"

def update_root_in_config(new_root):
    global root_url
    # Simulate a race condition by allowing concurrent updates
    root_url = new_root

def attacker_thread():
    # Simulate an attacker trying to change the root URL
    for _ in range(10):
        update_root_in_config("http://malicious-server.com")

# Start the attacker thread
threading.Thread(target=attacker_thread).start()

# Simulate a legitimate update
update_root_in_config("http://my-secure-server.com")

# Print the final root URL to show potential exploitation
print("Final root URL:", root_url)

import gradio as gr

def secure_update_root_in_config(new_root):
    # Ensure that the root URL is updated safely without race conditions
    # This is a simplified example to demonstrate the concept
    # In practice, proper locking mechanisms or atomic operations would be used
    global current_root
    current_root = new_root

current_root = "http://localhost:7860"  # Default root URL

# Example of how to safely update the root URL
secure_update_root_in_config("http://my-secure-server.com")

# Example payload to exploit the vulnerability by changing the root URL
malicious_payload = "http://malicious-server.com"

@misc{vaitp:cve202447870,
  title        = {{Race condition in Gradio allows URL modification, risking user data interception.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47870},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47870/}}
}