CVE-2021-43831: Local file access vulnerability in Gradio interface

# CVE-2021-43831: Local file access vulnerability in Gradio interface

https://gcdradar.vercel.app/incidents/cve-2021-43831-local-file-access-vulnerability-in-gradio-int · AIR-2022-0040 · closed 2021-12-15

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2021-12-15 (happened 2022-01-21)
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2021-43831
- CVSS: 9.3

## Summary

An arbitrary file read vulnerability exists in Gradio versions prior to 2.4.8 due to insecure static file serving. Attackers could access host files via exact relative paths when public links were active.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2022-01-21: CVE-2021-43831: Files on the host computer can be accessed from the Gradio interface (https://github.com/advisories/GHSA-rhq2-3vr9-6mcr)
- 2021-12-15: CVE-2021-43831: Gradio is an open source framework for building interactive machine learning models and demos. (https://nvd.nist.gov/vuln/detail/CVE-2021-43831)

## Sources

- 2021-12-15 NVD: CVE-2021-43831: Gradio is an open source framework for building interactive machine learning models and demos. https://nvd.nist.gov/vuln/detail/CVE-2021-43831
- 2022-01-21 GitHub Advisory Database: CVE-2021-43831: Files on the host computer can be accessed from the Gradio interface https://github.com/advisories/GHSA-rhq2-3vr9-6mcr

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.