CVE-2024-47084

Summary

CVE-2024-47084 is a vulnerability affecting the Gradio open-source Python package used for prototyping. This issue arises from a flaw in the Cross-Origin Resource Sharing (CORS) origin validation process of the Gradio server. When a cookie is present in a request, the server fails to validate the request origin, enabling unauthorized access. Malicious websites can exploit this vulnerability to make requests to local Gradio servers, potentially uploading files, stealing authentication tokens, and accessing user data. This issue impacts users deploying Gradio locally and utilizing basic authentication. To mitigate the risk, users are recommended to upgrade their Gradio version to 4.44 or higher. As an interim measure, users can modify the `CustomCORSMiddleware` class in their local Gradio server code to enforce stricter CORS origin validation and prevent potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.