Is CVE-2024-0964 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-0964 being exploited in the wild.

How severe is CVE-2024-0964?

High severity, with a CVSS score of 7.5, published 6 February 2024.

Which products and versions are affected?

gradio (PyPI) < 4.9.0, ECOSYSTEM:introduced=0,fixed=4.9.0.

Is there a fix for CVE-2024-0964?

Yes. gradio (PyPI): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-0964 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-0964?

Check whether you run gradio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-0964: Gradio path traversal in API request handling

Q: Which products and versions are affected?

gradio (PyPI) < 4.9.0, ECOSYSTEM:introduced=0,fixed=4.9.0.

Q: Is there a fix for CVE-2024-0964?

Yes. gradio (PyPI): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-0964 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-0964?

Check whether you run gradio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-0964 · Severity: high · CVSS 7.5 · Published 2024-02-06

Gradio, a popular Python library used to build web interfaces for machine learning models, is vulnerable to a security flaw that allows unauthorized access to files on the host server. By sending a specially crafted request to the application's API, an attacker can bypass directory restrictions to read sensitive system files. This could lead to the exposure of private data, configuration files, or credentials stored on the server.

Technologies: gradio (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-0964 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-0964 being exploited in the wild.
How severe is CVE-2024-0964?: High severity, with a CVSS score of 7.5, published 6 February 2024.
Which products and versions are affected?: gradio (PyPI) < 4.9.0, ECOSYSTEM:introduced=0,fixed=4.9.0.
Is there a fix for CVE-2024-0964?: Yes. gradio (PyPI): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-0964 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-0964?: Check whether you run gradio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gradio (PyPI): upgrade to 4.9.0 or later
```
pip install "gradio>=4.9.0"
```

Technical details

A path traversal vulnerability (CWE-22) exists in Gradio versions prior to 4.9.0. The flaw is rooted in improper validation of user-supplied JSON values within API requests, which are subsequently used to construct file paths. A remote, unauthenticated attacker can exploit this by submitting crafted path sequences (e.g., dot-dot-slash) to trigger a local file inclusion (LFI) and read sensitive files from the underlying filesystem. The vulnerability is reachable over the network with low complexity and requires no user interaction. The issue was addressed in version 4.9.0.

Affected products

gradio-app gradio < 4.9.0

Identifiers

CVE-2024-0964
GHSA-f3h9-8phc-6gvh
PYSEC-2024-261

Timeline

2024-02-05: disclosed: NVD publication date
2024-02-06: advisory: GitHub Advisory published
2023-12-12: patched: Fix commit merged into repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.