Gradio CORS Origin Validation Bypass Vulnerability Allowing Cross-Origin Data Exfiltration

A vulnerability has been identified in Gradio applications, specifically in versions through 5.29.1, allowing for a bypass of Cross-Origin Resource Sharing (CORS) origin validation. This issue arises in the CORS Handler component, where the 'is_valid_origin' function improperly manages the 'localhost_aliases' argument. As a result, malicious actors can remotely exploit this vulnerability to access sensitive data from internal applications, undermining Gradio's intended protections against such cross-origin attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data from internal Gradio applications, particularly in contexts where Gradio is used for handling secure data or hosting confidential applications.

Reproduction

To reproduce this vulnerability, deploy a Gradio application version through 5.29.1 on a local server. Then, send cross-origin requests from a different origin that either exploits IPv6 addressing or uses a public domain resolving to localhost, bypassing the application's CORS protections. This can be done using the exploitation payloads available in the referenced Gist.

Remediation

Users are advised to update Gradio to version 5.29.2 or later, where this vulnerability has been addressed.