CVE-2024-1729 - Vulnerability Details - OpenCVE

ReportizFlow

A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b
https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124

History

No history.

MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-03-29T04:35:12.067Z

Updated: 2024-08-01T18:48:21.924Z

Reserved: 2024-02-21T21:57:22.217Z

Link: CVE-2024-1729

Vulnrichment

Updated: 2024-08-01T18:48:21.924Z

NVD

Status : Awaiting Analysis

Published: 2024-03-29T05:15:45.477

Modified: 2024-11-21T08:51:10.860

Link: CVE-2024-1729

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1729", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-02-21T21:57:22.217Z", "datePublished": "2024-03-29T04:35:12.067Z", "dateUpdated": "2024-08-01T18:48:21.924Z"}, "containers": {"cna": {"title": "Timing Attack Vulnerability in gradio-app/gradio", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-04-16T11:10:24.181Z"}, "descriptions": [{"lang": "en", "value": "A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access."}], "affected": [{"vendor": "gradio-app", "product": "gradio-app/gradio", "versions": [{"version": "unspecified", "lessThan": "4.19.2", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124"}, {"url": "https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "cweId": "CWE-367"}]}], "source": {"advisory": "f6a10a8d-f538-4cb7-9bb2-85d9f5708124", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "gradio_project", "product": "gradio", "cpes": ["cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.19.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-29T14:49:03.873072Z", "id": "CVE-2024-1729", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T18:23:34.756Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.924Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124", "tags": ["x_transferred"]}, {"url": "https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124", "tags": ["x_transferred"]}, {"url": "https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.924Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1729", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-29T14:49:03.873072Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gradio_project:gradio:-:*:*:*:*:python:*:*"], "vendor": "gradio_project", "product": "gradio", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.19.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T18:23:27.817Z"}}], "cna": {"title": "Timing Attack Vulnerability in gradio-app/gradio", "source": {"advisory": "f6a10a8d-f538-4cb7-9bb2-85d9f5708124", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gradio-app", "product": "gradio-app/gradio", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "4.19.2", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/f6a10a8d-f538-4cb7-9bb2-85d9f5708124"}, {"url": "https://github.com/gradio-app/gradio/commit/e329f1fd38935213fe0e73962e8cbd5d3af6e87b"}], "descriptions": [{"lang": "en", "value": "A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-04-16T11:10:24.181Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1729", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:48:21.924Z", "dateReserved": "2024-02-21T21:57:22.217Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-03-29T04:35:12.067Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}