CVE-2024-47870

描述

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.

如何修補 CVE-2024-47870

要修補 CVE-2024-47870,請將受影響套件升級到下列已修補版本。

• —升級至 5.0.0 或更新版本
• —升級至 5.0.0 或更新版本

CVE-2024-47870 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 5.0.0
• from 0, < 5.0.0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-47870
• PATCHgithub.com/gradio-app/gradio
• WEBgithub.com/gradio-app/gradio/security/advisories/GHSA-xh2x-3mrm-fwqm
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-218.yaml