Gradio 5 Security Review

Hugging Face has partnered with cybersecurity firm Trail of Bits to conduct an independent security audit of Gradio 5. All security risks identified during this process were mitigated and fixed prior to the release of Gradio 5, ensuring that machine learning applications built with the library follow web security best practices without requiring developers to manually configure complex security policies.

Preemptive Security Audit Objectives

To ensure the safety of the more than 470,000 Gradio apps on Hugging Face Spaces, Hugging Face transitioned from a reactive patching model to a preemptive audit. Trail of Bits analyzed the Gradio codebase across four primary risk scenarios:

  • Local execution: Apps running on a developer's local machine.
  • Server deployment: Apps deployed on Hugging Face Spaces or other remote servers.
  • Server deployment: Apps shared via Gradio's built-in share links.
  • Supply chain: Vulnerabilities within the Gradio CI pipeline.

Major Security Findings and Mitigations

Trail of Bits identified several critical vulnerabilities across the four scenarios. All of these have been resolved in the Gradio 5.0 release.

Local Applications

Misconfigurations in the server's CORS (Cross-Origin Resource Sharing) policy were discovered (TOB-GRADIO-1 and TOB-GRADIO-2). In the context of an authenticated server, these could have allowed attackers to steal access tokens and take over user accounts via malicious websites.

Deployed Applications

Several vulnerabilities were identified for apps deployed on Hugging Face Spaces or other servers:

  • SSRF: A full read GET-based Server-Side Request Forgery (SSRF) allowed attackers to make requests to and read responses from arbitrary endpoints, including internal networks (TOB-GRADIO-3).
  • XSS: Arbitrary file type uploads could be used to host Cross-Site Scripting (XSS) payloads, which could lead to account takeovers in authenticated servers (TOB-GRADIO-10).
  • Race Conditions: A race condition existed that could allow attackers to reroute user traffic to their own servers to steal uploaded files or chatbot conversations (TOB-GRADIO-13).
  • File Leaks: Certain post-process functions in some components could leak arbitrary files in simple server configurations (TOB-GRADIO-16).

Shared Applications

Risks associated with Gradio's built-in share links included:

  • Remote Code Execution (RCE): An nginx misconfiguration exposed an unauthenticated docker API on the Gradio API Server, allowing for RCE with root user privileges. This could be used to redirect frp tunnels to a malicious server to record user traffic (TOB-GRADIO-19).

  • Encryption: A lack of robust encryption in communications between the frp-client and frp-server allowed for the interception and modification of data (TOB-GRADIO-11).

CI Pipeline and Supply Chain

Supply chain risks were identified in the Gradio CI pipeline:

  • GitHub Actions: Several workflows used third-party actions pinned to tags or branch names rather than full commit SHAs, risking silent modification of actions and potential secret leaks (TOB-GRADIO-25).

  • Runner Memory: A GitHub security researcher reported that GitHub actions could allow untrusted code execution and secret exfiltration via memory dumps of GitHub runners.

Future Security Posture

To prevent regressions and identify new vulnerabilities, Hugging Face has integrated several security-focused tools into the Gradio development lifecycle:

  • Security unit tests and fuzzer tests specifically designed to find vulnerabilities.
  • Static analysis tools such as Semgrep in the CI pipeline to detect common security issues.
  • Ongoing collaboration with the security community to identify and mitigate risks.

Sources