Gradio App Vulnerability Allows Unauthorized File Read Access

CVE-2024-1561

What is CVE-2024-1561?

A significant vulnerability exists within the Gradio product where the /component_server endpoint inadequately manages method invocations on the Component class while allowing input directed by attackers. By leveraging the move_resource_to_block_cache() method from the Block class, an attacker can copy any file residing on the filesystem to a temporary directory, making it retrievable. This local file read access vulnerability is particularly concerning for applications exposed to the internet using launch(share=True), as it provides unauthorized remote access to files on the host system. Additionally, applications hosted on huggingface.co may also be susceptible to this vulnerability, potentially revealing sensitive information including API keys and credentials stored within environment variables.

References