CVE-2024-12217 — MEDIUM (CVSS 5.3) AI Security Vulnerability

Q: Is CVE-2024-12217 actively exploited?

No confirmed active exploitation of CVE-2024-12217 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-12217?

1. IMMEDIATE: Deploy Gradio on Linux—NTFS ADS does not exist on Linux/macOS, eliminating this attack surface entirely. 2. SHORT-TERM: Place all Gradio instances behind an authenticated reverse proxy (Nginx + OAuth2 Proxy, or Cloudflare Access); never expose Gradio directly to the network. 3. DEFENSE-IN-DEPTH: Restrict the OS user running Gradio to a minimal permission set; ensure sensitive files (`.env`, credentials) are not readable by the Gradio process user. 4. DETECTION: Alert on HTTP requests containing `::$DATA`, `::$INDEX_ALLOCATION`, or other ADS stream suffixes in URL paths. 5. AUDIT: Inventory all Windows-based Gradio deployments; assume blocked_path bypass was possible and rotate any co-located credentials.

Q: What systems are affected by CVE-2024-12217?

This vulnerability affects the following AI/ML architecture patterns: ML demo applications, model serving, data science workstations, internal AI tools, agent frameworks.

Q: What is the CVSS score for CVE-2024-12217?

CVE-2024-12217 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.32%.

CISO Take

Gradio's `blocked_path` access control on Windows is trivially bypassed using NTFS Alternate Data Streams syntax (e.g., `file.txt::$DATA`), allowing unauthenticated network access to any file the server process can read. No patch is listed—migrate Windows Gradio deployments to Linux immediately or place them behind an authenticated reverse proxy. Rotate any credentials stored in files accessible to the Gradio process.

Risk Assessment

CVSS 5.3 understates operational risk. The vulnerability defeats the *only* access control mechanism Gradio provides (blocked_path), requires no authentication, no user interaction, and is exploitable by anyone with network access who knows about NTFS ADS—a well-documented Windows feature. EPSS is low (0.00133) indicating limited active exploitation, but exploitation complexity is trivial. Risk is highest for teams running Gradio on Windows workstations or servers with direct network exposure. No patch available increases residual risk significantly.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
gradio	pip	<= 5.0.1	No patch
42.5K OpenSSF 5.6 674 dependents Pushed 8d ago 27% patched ~110d to patch Full package profile →

Do you use gradio? You're affected.

Severity & Risk

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I None

A None

Recommended Action

5 steps

IMMEDIATE

Deploy Gradio on Linux—NTFS ADS does not exist on Linux/macOS, eliminating this attack surface entirely.
SHORT-TERM: Place all Gradio instances behind an authenticated reverse proxy (Nginx + OAuth2 Proxy, or Cloudflare Access); never expose Gradio directly to the network.
DEFENSE-IN-DEPTH: Restrict the OS user running Gradio to a minimal permission set; ensure sensitive files (.env, credentials) are not readable by the Gradio process user.
DETECTION

Alert on HTTP requests containing ::$DATA, ::$INDEX_ALLOCATION, or other ADS stream suffixes in URL paths.
AUDIT

Inventory all Windows-based Gradio deployments; assume blocked_path bypass was possible and rotate any co-located credentials.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Data Leakage Auth Bypass Framework API AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - Protection of AI system resources

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain the value of AI systems are in place

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2024-12217?

Gradio's `blocked_path` access control on Windows is trivially bypassed using NTFS Alternate Data Streams syntax (e.g., `file.txt::$DATA`), allowing unauthenticated network access to any file the server process can read. No patch is listed—migrate Windows Gradio deployments to Linux immediately or place them behind an authenticated reverse proxy. Rotate any credentials stored in files accessible to the Gradio process.

Is CVE-2024-12217 actively exploited?

No confirmed active exploitation of CVE-2024-12217 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-12217?

1. IMMEDIATE: Deploy Gradio on Linux—NTFS ADS does not exist on Linux/macOS, eliminating this attack surface entirely. 2. SHORT-TERM: Place all Gradio instances behind an authenticated reverse proxy (Nginx + OAuth2 Proxy, or Cloudflare Access); never expose Gradio directly to the network. 3. DEFENSE-IN-DEPTH: Restrict the OS user running Gradio to a minimal permission set; ensure sensitive files (`.env`, credentials) are not readable by the Gradio process user. 4. DETECTION: Alert on HTTP requests containing `::$DATA`, `::$INDEX_ALLOCATION`, or other ADS stream suffixes in URL paths. 5. AUDIT: Inventory all Windows-based Gradio deployments; assume blocked_path bypass was possible and rotate any co-located credentials.

What systems are affected by CVE-2024-12217?

This vulnerability affects the following AI/ML architecture patterns: ML demo applications, model serving, data science workstations, internal AI tools, agent frameworks.

What is the CVSS score for CVE-2024-12217?

CVE-2024-12217 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.32%.

Technical Details

NVD Description

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.

Exploitation Scenario

An attacker scans internal network ranges and identifies a Gradio ML demo running on a Windows data science server (common in enterprise ML teams). The application uses `blocked_path=['C:/app/.env', 'C:/app/config/secrets.json']` to protect credentials. The attacker issues a GET request for `C:/app/.env::$DATA`—Windows NTFS resolves the ADS stream notation transparently to the same file content, but Gradio's string comparison check only blocked the canonical path. The attacker receives the plaintext `.env` file containing the team's OpenAI API key and internal database connection string, enabling lateral movement into ML infrastructure and potential cost-harvesting abuse of the API key.