CVE-2024-47870

Summary

CVE-2024-47870 is a recently disclosed vulnerability affecting the Gradio open-source Python package. This issue involves a race condition in the `update_root_in_config` function, which allows an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server, potentially intercepting sensitive data such as authentication credentials or uploaded files. This vulnerability impacts all Gradio server users, with particular concern for those exposed to the internet, where malicious actors could exploit this race condition. Users are strongly urged to upgrade to Gradio version 5 or above to mitigate this risk. Unfortunately, there are currently no known workarounds for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.