Gradio Race Condition Vulnerability Could Lead to Data Interception

CVE-2024-47870

What is CVE-2024-47870?

Gradio, an open-source Python package used for rapid prototyping, is susceptible to a race condition in the update_root_in_config function. This flaw enables attackers to tamper with the root URL that the Gradio frontend utilizes to interface with the backend. Through this vulnerability, malicious actors can redirect legitimate user traffic to their own servers, compromising sensitive information such as authentication credentials and uploaded files. The risk is particularly pronounced for users operating Gradio servers on the internet, making it imperative for all users to upgrade to version gradio>=5 to mitigate potential threats. Presently, no workarounds exist for this issue.

References