A Security Review of Gradio 5

We audited Gradio 5 in order that your machine learning apps are secure!

Up to now few years, Gradio (>6 million monthly Pypi installs) has turn out to be the default option to construct machine learning web applications in Python. In only just a few lines of code, you’ll be able to create a user interface for a picture generation app, a chatbot, or every other type of ML app and share it with others using Gradio’s built-in share links or Hugging Face Spaces.

import gradio as gr
def generate(seed, prompt):  
    ...  
    return image
    

gr.Interface(
    generate,   
    inputs=[gr.Slider(), gr.Textbox()],  
    outputs=[gr.Image()]
).launch(share=True)  

Our goal with Gradio is to permit developers to construct web applications that work great out-of-the-box for machine learning use cases. This has meant letting you, as a developer, easily construct applications that:

• Scale easily to large numbers of concurrent users
• Are accessible to as many users as possible
• Provide consistent UI, UX, and theming
• Work reliably across numerous browsers and devices

…even for those who are usually not an authority in scaling, accessibility, or UI/UX!

Now, we’re adding web security to this list. We asked Trail of Bits, a widely known cybersecurity company, to conduct an independent audit of Gradio. The safety issues they found were all fixed ahead of the Gradio 5 release.

Because of this machine learning apps that you construct with Gradio 5 will follow best practices on the subject of web security with none significant changes to your code.

Why a security audit?

Up to now couple of years, the Gradio team has worked with the community to patch security vulnerabilities as they’re discovered. But as Gradio’s popularity has grown (with >470,000 Gradio apps currently on Hugging Face Spaces), ensuring security has turn out to be much more essential.

So in Gradio 5, we decided to take a distinct approach — do a preemptive security audit of the Gradio codebase in order that your machine learning applications built with Gradio 5 are secure by default. 

We asked Trail of Bits to conduct an independent and comprehensive audit of Gradio. Their team of experts in AI and Application Security identified security risks within the Gradio codebase in 4 general scenarios:

• Gradio apps running locally
• Gradio apps deployed on Hugging Face Spaces or other servers
• Gradio apps shared with built-in share links 
• Supply chain vulnerabilities originating from the Gradio CI pipeline

Then, we worked closely with Trail of Bits to discover mitigation strategies for every of those risks. Gradio’s simplicity and ease of use, while helpful for developers, also presented unique security challenges, as we didn’t want developers to wish to establish complex security measures like CORS and CSP policies.

By the top of the collaboration, we fixed all the security risks that were identified by Trail of Bits. All of the fixes were validated by Trail of Bits, and are included within the Gradio 5.0 release. While it’s unimaginable to prove the absence of security vulnerabilities, this can be a major step in giving reassurance that your Gradio apps are secure.

Major findings

We outline below the main security vulnerabilities that were discovered by Trail of Bits corresponding to the 4 scenarios above. Within the interest of transparency and the spirit of open-source, we’re making the full security report public, and more details for every of those issues could be present in the report.

Gradio apps running locally

• TOB-GRADIO-1 and TOB-GRADIO-2: Misconfigurations within the server’s CORS policy that, within the context of an authenticated Gradio server, would allow attackers to steal access tokens and take over a victim’s accounts after they visit their malicious website.

Gradio apps deployed on Hugging Face Spaces or other servers

• TOB-GRADIO-3: A full read GET-based SSRF that will allow attackers to make requests to and browse the responses from arbitrary endpoints, including those on the user’s internal network. 

• TOB-GRADIO-10: Arbitrary file type uploads that will allow an attacker to host XSS payloads on a user’s Gradio server. Within the context of an authenticated Gradio server, an attacker could use this to take over user accounts when the victim accesses an attacker’s malicious website.

• TOB-GRADIO-13: A race condition that permits an attacker to reroute user traffic to their server and steal uploaded files or chatbot conversations.

• TOB-GRADIO-16: Several components’ post-process functions could allow attackers to leak arbitrary files in quite simple Gradio server configurations.

Gradio apps shared with built-in share links

• TOB-GRADIO-19: Distant code execution (RCE) with the basis user on the Gradio API Server via a nginx misconfiguration that exposed the unauthenticated docker API. This allowed an attacker to offer a malicious host and port in step 2 of the diagram and redirect all frp tunnels to a malicious server that records all user traffic, including uploaded files and chatbox conversations.

• TOB-GRADIO-11: Lack of sturdy encryption in communications between the frp-client and frp-server, allowing attackers ready to intercept requests (those from steps 6 and seven within the diagram above) to read and modify the info going to and from the frp-server.

Supply chain vulnerabilities originating from the Gradio CI pipeline

• TOB-GRADIO-25: Several GitHub Actions workflows within the Gradio repository use third-party actions pinned to tags or branch names as a substitute of full commit SHAs. This might allow malicious actors to silently modify actions, potentially resulting in tampering with application releases or leaking secrets.

• Individually, a GitHub security researcher reported that our GitHub actions could allow untrusted code execution and secret exfiltration if an attacker triggered a workflow and cleverly dumped the memory of GitHub runners.

Going forward

We’re very grateful to Trail of Bits for the great security audit of Gradio and for validating the mitigations that we put in place for Gradio 5.

Going forward, we’re planning to proceed working with the safety community to discover and mitigate security issues in Gradio. We have now also added security unit tests to our test suite, fuzzer tests specifically designed to discover potential vulnerabilities, and are using static evaluation tools like Semgrep in our CI to detect common security issues in our code and stop security regressions.

We’re committed to making sure that as we proceed to develop Gradio 5 (and now we have a lot of plans!), we achieve this in a way that prioritizes security in order that we will do our part in making machine learning applications higher and safer.

Install Gradio 5 today:

pip install --upgrade gradio

And begin constructing your first Gradio 5 application.