CVE-2024-47084: Gradio: CORS bypass exposes local instances to credential theft

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.

Adversary identifies a target ML engineer known to use Gradio (via LinkedIn, GitHub commits, or conference talks). Engineer has Gradio 4.43 running on localhost:7860 with basic auth enabled for a team LLM evaluation interface. Adversary sends a spear-phishing email linking to a page that appears to be a relevant ML paper or dataset. When the engineer opens the link while their Gradio session is active, the attacker's JavaScript silently issues cross-origin requests to localhost:7860—Gradio skips CORS validation because the auth cookie is present. The attacker exfiltrates the session token, then uses it to upload a malicious file disguised as evaluation data, which gets processed through the model pipeline. In a more targeted scenario, the adversary maps the Gradio interface to discover connected data sources before exfiltrating model outputs or proprietary prompts.