CVE-2024-47165

Summary

CVE-2024-47165 is a vulnerability affecting the open-source Python package Gradio, which is used for quick prototyping. The problem lies in the CORS (Cross-Origin Resource Sharing) origin validation of the Gradio server, which unintentionally accepts a null origin. When deployed locally, the `localhost_aliases` variable of Gradio includes "null" as a valid origin. This opens the door for unauthorized requests from sandboxed iframes or other sources with a null origin, potentially resulting in data theft, such as user authentication tokens or uploaded files. Those using basic authentication are at a higher risk. To mitigate this issue, users are advised to upgrade to Gradio version 5.0 or later. As an interim measure, users can manually exclude "null" from their local Gradio deployment's `localhost_aliases` list to prevent the server from accepting requests from sandboxed iframes or sources with a null origin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.