Gradio FRP client download lacks integrity verification
Gradio's server downloads an FRP client without verifying its integrity, allowing potential attackers with access to the remote URL to modify the binary and introduce malicious code. The vulnerability was patched in version 5.0.
What happened
Gradio's server downloads an FRP client as part of its sharing mechanism but does not verify the file's checksum or signature.
An attacker with access to the remote URL from which the FRP client is downloaded could modify the binary without detection.
Reported impact
Users utilizing the Gradio server's sharing mechanism that downloads the FRP client could be affected, especially those relying on the executable binary for secure data tunneling.
Index analysis
The vulnerability was patched in Gradio version 5.0, which includes a fix to verify the integrity of the downloaded binary.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.