Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / gradio/PYSEC-2024-214
Advisory ID pypa/gradio/PYSEC-2024-214
Aliases CVE-2024-47165
GHSA-89v2-pqfv-c5r9
PYSEC-2024-214
Summary Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
Status Published
Exploitability 0.5
Weighted Severity 4.9
Risk 2.5
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3.1 5.4 https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2024-214.yaml
Reference id Reference type URL
https://github.com/gradio-app/gradio/security/advisories/GHSA-89v2-pqfv-c5r9
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/pypa/advisory-database/blob/main/vulns/gradio/PYSEC-2024-214.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-11T15:25:38Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/47xxx/CVE-2024-47165.json

Source Advisory: vulnrichment/CVE-2024-47165

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]