Gradio vulnerabilities

A vulnerability in Gradio before version 6.20.0 allows open redirect and server-side request forgery (SSRF) via unvalidated URLs in the file_fetch() function at the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response to access internal endpoints such as cloud metadata services to steal sensitive credentials, including EC2 IAM role credentials.

A path traversal vulnerability in the FileExplorer component of Gradio before version 6.16.0 allows unauthenticated attackers to read files outside the configured root directory. Attackers can use traversal sequences or absolute paths that cause os.path.join to discard the root_dir prefix.

A security flaw in gradio-app gradio 6.14.0 affects the save_audio_to_cache function of the Audio Cache Key Handler component. Manipulation leads to use of weak hash. The attack requires local access, is difficult to exploit, but the exploit is publicly available.

Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.

Gradio is an open-source Python library used to build machine learning and data science applications. Due to a lack of path filtering, Gradio does not properly restrict file access to users and does not properly restrict what URLs are proxied. These issues have been addressed in version 3.34.0.