Non-constant-time comparison when comparing hashes in Gradio

Vulnerability

Overview

CVE-2024-47869 is a timing side-channel vulnerability in the Gradio open-source Python package, affecting the analytics_dashboard function. The root cause is that Gradio compares hashes in a non-constant-time manner (i.e., it terminates early on the first mismatched byte). An attacker can exploit this by repeatedly querying the system with different keys and measuring the response time; longer responses indicate a closer match to the correct hash, allowing the attacker to infer the hash byte-by-byte [1][2][4].

Exploitation and

Attack Surface

Exploitation requires the ability to send multiple requests to the Gradio server's analytics dashboard endpoint, typically over a local or network-accessible connection. No special privileges are needed beyond network access, as the vulnerability lies in the comparison logic itself. The timing differences are small, but with repeated queries and statistical analysis, an attacker can determine the correct hash without knowing it in advance [2][3].

Impact

Successful exploitation permits unauthorized access to the analytics dashboard, potentially exposing sensitive usage metrics, configuration details, or other data served by that endpoint. While the dashboard itself may not directly contain high-risk secrets, its exposure could assist in further attacks or violate data privacy expectations [4].

Mitigation

Status

Users are advised to upgrade to Gradio version 4.44 or later, where the hash comparison has been replaced with a constant-time function. For those unable to upgrade immediately, two workarounds exist: (1) manually patch the comparison logic in the analytics_dashboard function to use a constant-time comparison, or (2) disable access to the analytics dashboard entirely [2][4].