CVE-2023-34239
published 2023-06-08CVE-2023-34239: Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly…
PriorityP350critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.65%
46.5th percentile
Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gradio-app | gradio | < 3.34.0 | 3.34.0 |
| gradio_project | gradio | < 3.34.0 | 3.34.0 |
| gradio_project | gradio | >= 0 < 3.34.0 | 3.34.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
ghsa·2023-06-09
CVE-2023-34239 [MEDIUM] CWE-20 Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
### Impact
There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs
### Patches
Both problems have been solved, please upgrade `gradio` to `3.34.0` or higher
### Workarounds
Not possible to workaround except by taking down any shared Gradio apps
### References
Relevant PRs:
* https://github.com/gradio-app/gradio/pull/4406
* https://github.com/gradio-app/gradio/pull/4370
OSV
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
osv·2023-06-09
CVE-2023-34239 [MEDIUM] Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
### Impact
There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs
### Patches
Both problems have been solved, please upgrade `gradio` to `3.34.0` or higher
### Workarounds
Not possible to workaround except by taking down any shared Gradio apps
### References
Relevant PRs:
* https://github.com/gradio-app/gradio/pull/4406
* https://github.com/gradio-app/gradio/pull/4370
OSV
CVE-2023-34239: Gradio is an open-source Python library that is used to build machine learning and data science
osv·2023-06-08
CVE-2023-34239 CVE-2023-34239: Gradio is an open-source Python library that is used to build machine learning and data science
Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. These issues have been addressed in version 3.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/gradio-app/gradio/pull/4370https://github.com/gradio-app/gradio/pull/4406https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695https://github.com/gradio-app/gradio/pull/4370https://github.com/gradio-app/gradio/pull/4406https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695
2023-06-08
Published