Gradio erlaubt Benutzern, beliebige Dateien zu greifen

The primary impact of CVE-2024-1728 is unauthorized access to files residing on the server hosting the Gradio application. Attackers can exploit this vulnerability by manipulating network requests, effectively bypassing intended access controls. The scope of accessible files depends on the server's configuration and permissions, potentially exposing sensitive data such as configuration files, source code, or even user data. While there's no current evidence of active exploitation, the public nature of Gradio deployments on platforms like Hugging Face Spaces increases the attack surface and potential for widespread compromise.

Organizations and individuals deploying Gradio applications with public links, particularly those hosted on platforms like Hugging Face Spaces, are at risk. This includes machine learning engineers, data scientists, and developers who rely on Gradio for building and sharing interactive model demos. Legacy Gradio deployments and those with overly permissive file system permissions are particularly vulnerable.

• python / gradio: Monitor Gradio application logs for unusual file access attempts.

import logging
logging.basicConfig(filename='gradio_app.log', level=logging.INFO)
# ... your Gradio app code ...

• generic web: Inspect access logs for requests targeting unusual file paths within the Gradio application directory. • generic web: Check response headers for unexpected file content types or sizes. • generic web: Use curl to attempt accessing files outside the intended application directory (e.g., /../../etc/passwd).

curl 'http://your-gradio-app.com/../../etc/passwd'

1. 2024-09-25Disclosure

   disclosure

1. Reserviert2024-02-21
2. Veröffentlicht2024-09-25
3. Geändert2026-02-03
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-1728 is to immediately upgrade Gradio to version 4.19.2 or higher. This version includes a fix that addresses the underlying vulnerability. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing stricter network security controls around the Gradio application. This could involve using a Web Application Firewall (WAF) to filter malicious requests or implementing proxy servers to inspect and sanitize traffic. Thoroughly review and restrict file access permissions on the server hosting the Gradio application to limit the potential damage from a successful exploit. After upgrading, confirm the fix by attempting to access files outside of the intended application scope via network requests.