CVE-2024-4253
published 2024-06-04CVE-2024-4253: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises…
PriorityP356critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.69%
74.2th percentile
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/[email protected]'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gradio-app | gradio-app_gradio | >= unspecified < 4.29.0 | 4.29.0 |
| gradio_project | gradio | < 4.29.0 | 4.29.0 |
| russh_project | russh | >= 0 < 0.44.1 | 0.44.1 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Russh has an OOM Denial of Service due to allocation of untrusted amount
ghsa·2024-08-14
CVE-2024-43410 [HIGH] CWE-770 Russh has an OOM Denial of Service due to allocation of untrusted amount
Russh has an OOM Denial of Service due to allocation of untrusted amount
### Summary
Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server.
### Details
An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length.
After parsing and potentially decrypting the 4-byte length, russh allocates enough memory for this bytestream, as a performance optimization to avoid reallocations later.
https://github.com/Eugeny/russh/blob/4eaa080e7532662023f75e8fff45b743fe607f8c/russh/src/cipher/mod.rs#L254
But this length is entirely untrusted and can be set to any value by the client, causing this much memory to be allocated, which will cause the process to OOM within a few such requests.
RFC 4253 contains an explicit section o
GHSA
GHSA-r897-wrpm-h4vw: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional
ghsa_unreviewed·2024-06-04
CVE-2024-4253 [HIGH] CWE-77 GHSA-r897-wrpm-h4vw: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/[email protected]'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-04
Published