Executive brief
Gradio is a popular framework for building machine learning demos and interfaces that can be shared publicly over the internet. When users enable the share=True feature, Gradio establishes a connection through a reverse proxy (FRP) server to make their application accessible. This vulnerability allows attackers to intercept unencrypted traffic between the client and proxy server, potentially exposing uploaded files, modifying responses, or stealing sensitive data transmitted through the application.
Technical details
The vulnerability is a lack of encryption (CWE-311) in the communication channel between Gradio's FRP client and the FRP server. When share=True is enabled, HTTPS is not enforced on the FRP connection, leaving the channel vulnerable to man-in-the-middle (MITM) attacks. An attacker with network access to the path between the client and FRP server can intercept, read, and modify traffic containing uploaded files and application responses. The vulnerability affects all Gradio versions prior to 5.0.0 and is fixed in version 5.0.0 and later. Users can work around this by disabling share=True in production and instead hosting on HTTPS-enabled servers.
Affected products
- Gradio Gradio < 5.0.0
Timeline
- 2024-10-10: disclosed
- 2024-10-10: patched: Version 5.0.0 released