CVE-2024-1561

Gradio vulnerability

CVSS

7.5

EPSS

9.2%

EPSS pct

95th

Exploited

No known

An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.

Affected vendor

Gradio Project

Affected product

Gradio

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)

CWE-29

Published

2024-04-16

Risk analysis

Based on its CVSS vector, this vulnerability is exploitable over the network, low attack complexity, requiring no privileges, no user interaction. Successful exploitation leads to high impact to confidentiality.

Its EPSS score of 9.2% reflects a lower probability of exploitation activity in the wild over the next 30 days, placing it above 95% of all scored CVEs.

Check your external exposure to CVE-2024-1561

Confirm whether Gradio Project Gradio is running on any internet-facing host or subdomain.
Match discovered service fingerprints against the version affected by CVE-2024-1561.
Prioritise remediation if the asset is public, business-critical, or near authentication/payment flows.

How ThreatPort helps with CVE-2024-1561

ThreatPort's external attack surface scanner checks your internet-facing assets — agentlessly, from the outside in — for the exposed services and versions that CVE-2024-1561 affects, then prioritises the finding by real risk using CISA KEV and FIRST.org EPSS.

Run a free external exposure scan

Are you exposed to CVE-2024-1561?

Run an instant, non-intrusive external scan to check your attack surface for CVE-2024-1561.

Start free scan

No credit card. Agentless.

Related vulnerabilities

HIGH

CVE-2017-12090

Micrologix 1400 B Firmware vulnerability

Spring Framework vulnerability