CVE-2024-1561: Gradio Information Disclosure Vulnerability

CVE-2024-1561 Overview

CVE-2024-1561 is a local file read vulnerability in gradio-app/gradio, an open-source Python framework for building machine learning web interfaces. The /component_server endpoint permits invocation of any method on a Component class using attacker-controlled arguments. By calling the move_resource_to_block_cache() method on the Block class, a remote attacker can copy arbitrary files from the host filesystem into a temporary directory and retrieve them over HTTP. Applications launched with launch(share=True) and Gradio apps hosted on huggingface.co are exposed to remote exploitation, risking disclosure of API keys, credentials, and other secrets stored in environment variables.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host, including environment variables and credential material used by Gradio and Hugging Face deployments.

Affected Products

gradio-app/gradio (Python package) prior to version 4.13.0
Gradio applications exposed publicly via launch(share=True)
Gradio Spaces hosted on huggingface.co

Discovery Timeline

2024-04-16 - CVE-2024-1561 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1561

Vulnerability Analysis

The vulnerability is a path traversal and unrestricted method invocation flaw classified under [CWE-29] (Path Traversal: \..\filename). Gradio's /component_server route was designed to let the front-end call server-side helper methods on Component instances. The route resolves the target method via Python's getattr(block, body.fn_name) without validating whether the requested attribute is an authorized server function.

Attackers abuse move_resource_to_block_cache(), inherited from the Block base class. This method accepts a source path argument and copies the referenced file into Gradio's temporary cache directory. Because the cache directory is served over HTTP by Gradio itself, the attacker can subsequently request the copied file and exfiltrate its contents.

The EPSS score of 9.239% (94th percentile) indicates elevated real-world exploitation probability relative to typical CVEs.

Root Cause

The root cause is missing authorization on server-invoked methods. The /component_server handler treats every callable attribute of a Component instance as a valid endpoint. There is no allowlist marking which methods are intended to be reachable from the client, and no validation of file path arguments before they are passed to filesystem operations.

Attack Vector

Exploitation requires only network access to a vulnerable Gradio instance. The attacker sends a crafted POST request to /component_server naming move_resource_to_block_cache as the fn_name and supplying an absolute path such as /etc/passwd, /proc/self/environ, or ~/.aws/credentials as the argument. Gradio copies the file into its temporary cache, then the attacker retrieves the file via a subsequent HTTP GET.

python

# Security patch in gradio/routes.py - Component Server fix (#6884)
                block = state[component_id]
            else:
                block = app.get_blocks().blocks[component_id]
-            fn = getattr(block, body.fn_name)
+            fn = getattr(block, body.fn_name, None)
+            if fn is None or not getattr(fn, "_is_server_fn", False):
+                raise HTTPException(
+                    status_code=status.HTTP_404_NOT_FOUND,
+                    detail="Function not found.",
+                )
            return fn(body.data)

Source: gradio-app/gradio commit 24a5836

The patch introduces a _is_server_fn marker attribute. Only methods explicitly decorated as server functions are callable through /component_server, blocking arbitrary method invocation.

Detection Methods for CVE-2024-1561

Indicators of Compromise

POST requests to /component_server where the JSON body fn_name field references move_resource_to_block_cache, ls, or other non-standard method names
Unexpected files appearing in the Gradio temp cache directory (typically under /tmp/gradio/ on Linux) that mirror sensitive host paths
HTTP GET requests fetching files from the Gradio cache directory immediately after /component_server POST activity from the same source IP
Outbound requests to Gradio Share tunnel URLs (*.gradio.live) from unexpected hosts

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to /component_server and correlate fn_name values against the known-safe allowlist introduced in Gradio 4.13.0
Monitor Gradio process file access using auditd or eBPF sensors for reads of sensitive paths such as /etc/passwd, ~/.ssh/, or /proc/*/environ by the Python interpreter running Gradio
Alert on Gradio applications running with share=True in production environments, as they expose the endpoint via public tunnels

Monitoring Recommendations

Baseline the set of fn_name values seen in legitimate /component_server traffic and alert on new values
Track Gradio package versions across development and production hosts using software inventory tooling; flag installations below 4.13.0
Enable egress monitoring for temporary sharing tunnels and public Hugging Face Spaces that host internal Gradio applications

How to Mitigate CVE-2024-1561

Immediate Actions Required

Upgrade gradio to version 4.13.0 or later, which enforces the _is_server_fn allowlist on /component_server
Rotate any API keys, tokens, and credentials that were accessible via environment variables on affected hosts, especially for public Hugging Face Spaces
Audit historical access logs for /component_server POST requests and investigate any that reference unexpected fn_name values

Patch Information

The fix ships in Gradio 4.13.0. See the Gradio Changelog 4.13.0 and the upstream fix in gradio-app/gradio commit 24a5836. Technical details are documented in the Huntr Bug Bounty Report.

Workarounds

Avoid launching Gradio applications with launch(share=True) until the host is patched, since this exposes the vulnerable endpoint through a public tunnel
Restrict network access to Gradio instances using a reverse proxy with authentication or IP allowlisting
Run Gradio under a low-privilege service account with restricted filesystem permissions so sensitive files are unreadable to the process
Remove secrets from process environment variables and load them from a secrets manager scoped to the application

bash

# Upgrade Gradio to the patched release
pip install --upgrade "gradio>=4.13.0"

# Verify the installed version
python -c "import gradio; print(gradio.__version__)"