Gradio enable_monitoring flag fails to disable monitoring (CVE-2024-47168)
Gradio's enable_monitoring flag, when set to False, fails to properly disable access to the monitoring dashboard. Unauthorized users can bypass the security setting by directly accessing the /monitoring endpoint, potentially exposing sensitive application analytics.
What happened
The enable_monitoring flag in Gradio, when set to False, does not properly disable monitoring. Attackers or unauthorized users can still access the monitoring dashboard by directly requesting the /monitoring endpoint even when monitoring is supposedly disabled.
Reported impact
Sensitive application analytics may be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted.
Index analysis
This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False.
Governance controls
Gradio released a patch in version 4.44 to address this issue.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.