CVE-2024-4941
Description
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.
How to fix
- gradio_project gradio4.31.4 or later
- gradio4.31.3, 4.31.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gradio_project gradio | v < 4.31.4 | 4.31.4 |
| gradioPyPI | v < 4.31.3, v < 4.31.4 | 4.31.3, 4.31.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.