CORS origin validation bypassed in Gradio with cookies (CVE-2024-47084)
Gradio's CORS validation was not performed when cookies were present, allowing attackers to make unauthorized requests to local Gradio servers and potentially steal authentication tokens or user data. The vulnerability was patched in version 4.44.
What happened
Gradio server fails to validate the request origin when a cookie is present, allowing an attacker's website to make unauthorized requests to a local Gradio server.
The vulnerability exists in the CustomCORSMiddleware class, which skips CORS validation for requests containing cookies.
Reported impact
Attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio.
The vulnerability impacts users who have deployed Gradio locally and use basic authentication.
Index analysis
The vulnerability was patched in Gradio version 4.44 and earlier versions remain affected.
As a workaround, users can manually enforce stricter CORS origin validation by modifying the CustomCORSMiddleware class to bypass the condition that skips validation for requests containing cookies.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.