CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio
Timing attack in Gradio allows attackers to bypass authentication and access the analytics dashboard by inferring hashes via response time analysis.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47869?
CVE-2024-47869 is a low-severity vulnerability in Gradio Project Gradio, published on 10 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys. Users are advised to upgrade to `gradio>4.44` to mitigate this issue. To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
Weakness: CWE-203
Which versions are affected by CVE-2024-47869?
3 open source packages ship an affected version, including gradio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradio PyPI | All versions | 4.44.0 |
gradio PyPI | All versions | 4.44.0 |
gradio PyPI | All versions | 4.44.0 |
Products include Gradio Project Gradio.
How do I fix CVE-2024-47869?
Upgrade gradio to 4.44.0 or later.
Is CVE-2024-47869 being exploited?
There is no known exploitation of CVE-2024-47869 in the wild and no public exploit code.
Other vulnerabilities in Gradio Project Gradio
- CVE-2024-39236 Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
- CVE-2023-6572 Command Injection in gradio-app/gradio
- CVE-2022-24770 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
- CVE-2026-49119 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
- CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability
Sources
Also known as GHSA-j757-pf57-f8r4, PYSEC-2024-199.