Gradio Vulnerability: Insecure Communication Exposes Sensitive Data
CVE-2024-47871

9.1CRITICAL

Key Information:

Vendor

Gradio-app

Status
Gradio
Vendor
CVE Published:
10 October 2024

What is CVE-2024-47871?

The Gradio open-source Python package has a vulnerability that allows insecure communication between the Fast Reverse Proxy (FRP) client and server when the share=True option is enabled. This flaw does not enforce HTTPS on the connection, making it susceptible to eavesdropping. Attackers are able to intercept uploaded files and modify data exchanged between clients and servers. This is particularly critical for users sharing Gradio demonstrations publicly without proper encryption, potentially jeopardizing sensitive information. Users are encouraged to upgrade to Gradio version 5 or higher to remediate this issue. As an immediate measure, users should refrain from employing the share=True option in production and instead utilize HTTPS-enabled servers for hosting Gradio applications.

Affected Version(s)

gradio < 5.0.0

References

https://github.com/gradio-app/gradio/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.