Lack of integrity check in Gradio server potentially allows attackers to introduce malicious code

CVE-2024-47867

What is CVE-2024-47867?

The vulnerability in Gradio arises from the absence of integrity checks on the FRP (Fast Reverse Proxy) client’s downloads. This vulnerability theoretically allows an attacker to intercept the download URL, modify the binary of the FRP client, and deliver a compromised version without detection since the Gradio application does not implement checksum or signature verification for the files it retrieves. This risk particularly endangers users who utilize Gradio's sharing functionality that relies on the FRP client, mainly those who count on this binary for secure data tunneling. Users are encouraged to adopt manual integrity checks in their environments as an interim solution until the Gradio software can be updated to address this issue.

References