Insecure communication between the FRP client and server in Gradio

Vulnerability

Overview

CVE-2024-47871 concerns an insecure communication channel when Gradio uses share=True. In this mode, the FRP (Fast Reverse Proxy) client connects to Gradio's FRP server without enforcing HTTPS, leaving data transmitted over the tunnel unencrypted [1][2][4]. An attacker on the network path can therefore read any files uploaded to the Gradio demo and tamper with responses or other data exchanged between the client and the server [2][4].

Attack

Vector

Exploitation requires network access to the traffic between the FRP client and server. No authentication is needed beyond being able to observe or intercept the unencrypted communication link. Users who rely on share=True to publicly share Gradio demos over the internet are the primary targets, as their data flows through an external reverse proxy without transport-layer security [2][4]. The vulnerability does not require any special privileges or user interaction beyond the normal use of the shared demo.

Impact

A successful attacker can capture uploaded files and modify responses or data in transit, leading to information disclosure and potential data integrity compromises [2][4]. This is especially critical when sensitive datasets or model inputs are shared via Gradio's public sharing feature. The CVSS 4.0 score assigned by NVD reflects the high potential for confidentiality and integrity impact [2].

Mitigation

The official fix upgrades Gradio to version 5 or later, which enforces HTTPS for the FRP connection [2][4]. As a workaround, users should avoid using share=True in production and instead deploy Gradio on servers with HTTPS enabled to ensure end-to-end encryption [2][4]. No other workarounds have been provided, and the vulnerability is listed in the PyPA advisory database [3].