AI agent vulnerability · Gradio

CVE-2024-47869: Gradio performs a non-constant-time comparison when comparing hashes

mediumCVSS 4.0 6.3 · 3.1 3.7GHSA-j757-pf57-f8r4

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte.

Published Oct 10, 2024 · Updated Jan 21, 2025

Affected packages

gradio

Ecosystem: PyPI
Affected: < 4.44.0
Fixed in: 4.44.0
Check: pip show gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

What kind of vulnerability is it? Who is impacted?

This vulnerability involves a timing attack in the way Gradio compares hashes for the analytics_dashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys.

Patches

Yes, please upgrade to gradio>4.44 to mitigate this issue.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

To mitigate the risk before applying the patch, developers can manually patch the analytics_dashboard dashboard to use a constant-time comparison function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.

Credited to ahpaleus, Vasco-jofra.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries