CVE-2024-10569

Executive Summary

CVE-2024-10569 is a denial-of-service (DoS) vulnerability in the Gradio web application framework, specifically within its dataframe component. The vulnerability allows an unauthenticated attacker to upload a maliciously crafted zip bomb (a highly compressed archive that expands to an enormous size) via the pd.read_csv function. When the server attempts to decompress and parse this file, it exhausts system resources (CPU, memory, disk), leading to a server crash and service unavailability. The vulnerability affects Gradio version git 98cbcae and potentially earlier versions. No patch is currently available, and no public proof-of-concept (PoC) code has been released.

Supply Chain & Package Security

Gradio is a Python package distributed via PyPI. This vulnerability affects the core library, not a third-party plugin. Users should monitor the official Gradio repository for patch releases and consider pinning versions or implementing input validation as a temporary workaround.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The high availability impact and low attack complexity make this a significant threat for any Gradio instance exposed to the internet.

Deep Dive & Mechanics

The vulnerability lies in the dataframe component of Gradio, which uses the pd.read_csv function from the Pandas library to process user-uploaded CSV files. The pd.read_csv function, by default, supports reading from compressed files (e.g., .zip, .gz, .bz2). An attacker can craft a zip bomb—a small zip file containing a highly nested or massively expanded CSV file. When Gradio calls pd.read_csv on this file, the Pandas library attempts to decompress and parse the entire contents, causing memory exhaustion and CPU overload.

The attack flow:

1. Attacker creates a zip bomb (e.g., a zip file containing a CSV with billions of rows or a deeply nested zip structure).
2. Attacker uploads this file to the Gradio dataframe component.
3. Gradio passes the file to pd.read_csv, which decompresses and attempts to load the entire dataset into memory.
4. The server runs out of memory or CPU, causing a crash or hang.

Vulnerable vs. Patched Code

Vulnerable Code (git 98cbcae):

# In gradio's dataframe component
import pandas as pd

def process_dataframe(file):
    # Directly reads the uploaded file without size or decompression limits
    df = pd.read_csv(file)
    return df

Patched Code (Hypothetical):

# Patched version with input validation and resource limits
import pandas as pd
import os

def process_dataframe(file):
    # Check file size before processing
    max_size = 10 * 1024 * 1024  # 10 MB
    if os.path.getsize(file) > max_size:
        raise ValueError("File too large")
    
    # Disable compression support or limit decompression
    df = pd.read_csv(file, compression=None)  # Only accept uncompressed files
    return df

The patch should either disable compressed file support entirely or implement strict size limits and decompression bombs detection.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install Gradio version git 98cbcae: pip install gradio==98cbcae
2. Create a zip bomb using a tool like zipbomb or manually:

   # Create a 10GB CSV file with repeated data
   python -c "print('a,' * 10000000)" > bomb.csv
   # Compress it into a zip bomb
   zip -9 bomb.zip bomb.csv
   

3. Start a Gradio app with a dataframe component:

   import gradio as gr
   
   def process(file):
       return "Uploaded"
   
   iface = gr.Interface(fn=process, inputs=gr.File(), outputs="text")
   iface.launch()
   

4. Upload the bomb.zip file to the dataframe component.

Expected Outcome: The server will crash or become unresponsive due to memory exhaustion.

Blue Team (Defender)

Detection & Prevention:

• Monitor for large file uploads or unusual memory spikes.
• Implement a Web Application Firewall (WAF) rule to block zip files or limit upload sizes.
• Use a reverse proxy (e.g., Nginx) to enforce file size limits:

  client_max_body_size 10M;
  

• Disable compressed file support in Pandas by patching the Gradio source code.

Indicators of Compromise (IOCs)

• Network: Unusually large HTTP POST requests to Gradio endpoints (e.g., /upload).
• System: High memory and CPU usage on the Gradio server.
• File: Presence of abnormally small zip files that expand to gigabytes when decompressed.
• Logs: Error logs from Pandas indicating memory allocation failures or out-of-memory errors.

Detection Engineering

YARA Rule

rule ZipBomb_Detection {
    meta:
        description = "Detects zip bombs targeting Gradio dataframe component"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10569"
    strings:
        $zip_magic = { 50 4B 03 04 }  // ZIP local file header
        $csv_header = "a,"  // Common CSV header pattern
    condition:
        $zip_magic at 0 and filesize < 100KB and for any of ($csv_header*): (# > 1000)
}

Sigma Rule

title: Gradio Zip Bomb Upload Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to upload zip bombs to Gradio dataframe component
author: Valters IT
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http_method: POST
        uri: '/upload'
        body_length: '> 1000000'  # 1 MB
    condition: selection
falsepositives:
    - Legitimate large file uploads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Gradio Zip Bomb Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; pcre:"/Content-Length:\s*\d{7,}/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable compressed file support: Modify the Gradio source code to pass compression=None to pd.read_csv.
2. Implement file size limits: Use a reverse proxy (Nginx, Apache) to limit upload sizes to 10-50 MB.
3. Monitor for anomalies: Set up alerts for high memory usage or large file uploads.

Long-Term Fix:

• Wait for an official patch from the Gradio team. Monitor the GitHub repository for updates.
• Consider using a different CSV parsing library that does not support compressed files by default.

Workaround:

• If patching is not possible, restrict access to the Gradio application to trusted users only (e.g., via VPN or authentication).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert