Gradio File Upload Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Gradio version 0.39.1, specifically within the file upload feature. The issue arises from improper management of form-data that includes large filenames. When a payload with an excessively large filename is uploaded, the server becomes overwhelmed and unresponsive, disrupting service for legitimate users.

Impact

Exploiting this vulnerability causes the server to become unresponsive, disrupting access to the service for all users. This creates a denial-of-service scenario, making the application completely unusable.

Reproduction

To reproduce this vulnerability, upload a file through the Gradio file upload interface. The upload button can be configured to accept a single file. After the file is uploaded, a download button becomes available to download the file. Once the upload process is complete, send a POST request to the file upload endpoint with a multipart form-data payload that includes a filename excessively large, approximately 50 million characters long. Include the necessary headers, such as 'Content-Type' and 'Cookie', to simulate a real upload request.