CVE-2024-47871

Summary

CVE-2024-47871 is a vulnerability affecting the open-source Python package Gradio, used for quick prototyping. This issue involves insecure communication between the Fast Reverse Proxy (FRP) client and server when `share=True` is used. HTTPS is not enforced, enabling attackers to intercept and read uploaded files, modify responses, and manipulate data exchanged between the client and server. Users sharing Gradio demos publicly over the internet without proper encryption are at risk of exposing sensitive data. To address this vulnerability, users are advised to upgrade to Gradio version 5 or higher. A workaround includes avoiding `share=True` in production environments and hosting applications on servers with HTTPS enabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.