CVE-2024-4941

Local file inclusion vulnerability in gradio-app due to improper input validation.

• CVSS 7.5
• CWE-22
• Input Validation and Sanitization
• Remote

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.

CVE

CVE-2024-4941

CWE

CWE-22

CVSS base score

7.5

Published

2024-06-06

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Local File Inclusion (LFI)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

gradio-app

Fixed by upgrading

Yes

Solution

Upgrade to gradio version 4.26 or later, and implement strict input validation to prevent user-controlled paths from being processed.

import json
import os
from processing_utils import move_files_to_cache

def postprocess(user_input):
    """Vulnerable function that demonstrates the security issue."""
    parsed_json = json.loads(user_input)
    
    if isinstance(parsed_json, dict) and 'path' in parsed_json:
        file_path = parsed_json['path']
        move_files_to_cache(file_path)

user_input = '{"path": "/etc/passwd"}'
postprocess(user_input)

import json
import os
from processing_utils import move_files_to_cache

ALLOWED_BASE_DIR = "/app/uploads"

def check_path(base_path, target_path):
    """Secure function that fixes the vulnerability."""
    base_path = os.path.abspath(base_path)
    target_path = os.path.abspath(target_path)
    return os.path.commonpath([base_path]) == os.path.commonpath([base_path, target_path])

def postprocess(user_input):
    """Secure function that fixes the vulnerability."""
    parsed_json = json.loads(user_input)
    
    if isinstance(parsed_json, dict) and 'path' in parsed_json:
        file_path = parsed_json['path']
        if check_path(ALLOWED_BASE_DIR, file_path):
            move_files_to_cache(file_path)
        else:
            raise ValueError("Unsafe file path detected.")

user_input = '{"path": "/etc/passwd"}'
postprocess(user_input)

{"path": "/etc/passwd"}

@misc{vaitp:cve20244941,
  title        = {{Local file inclusion vulnerability in gradio-app due to improper input validation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-4941},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-4941/}}
}