Gradio /proxy SSRF Cookie Injection Leading to Cross-Space Session Fixation

Vulnerability Overview This vulnerability involves a cross-space cookie injection issue in Gradio Proxy. Gradio's reverse proxy endpoint utilizes a module-level that is shared across all users and all requests. The automatically persists response headers, replaces them in its internal cookie jar, and re-sends these cookies in subsequent requests. Because the endpoint restricts targets to (as an SSRF protection measure), all proxied requests share the same parent domain. An attacker who controls any HF Space can return a header. Consequently, will store this as a parent domain cookie and inject it into every subsequent request, including those targeting legitimate Spaces. This results in cross-space session fixation. Scope of Impact Impact Scope: All HF Spaces using Gradio Proxy. Attack Scenario: An attacker deploys a malicious Space, which returns specific headers via the endpoint, thereby injecting parent domain cookies into all proxied requests. Consequences: Cross-space session fixation, potentially leading to user session hijacking. Remediation Remediation Verification: Confirm the vulnerability by deploying a real HF Space and verifying whether HF's infrastructure strips or modifies response headers. Specific Steps: 1. Deploy a malicious Space that returns . 2. User A accesses the Gradio application and triggers any output, causing a file download via from the attacker's Space. 3. Gradio server's shared receives this response; parses and stores the cookie in the parent domain. 4. User B accesses the same Gradio application. Their next request via (whether targeting the attacker's Space or a completely legitimate Space) now carries the attacker's cookie. 5. If the legitimate Space uses for authentication, it will now process User B's request as the attacker's session, resulting in cross-space session fixation. POC Code Logs ```python Step 4: Failing test __main__ == { "x1": 17785602.757045, "y1": -11188888.0, "x2": 17785602.757045, "y2": -11188888.0, "text": "test_cookie=ATTACKER_KNOWN_VALUE", "font_size": 100, "font_color": "#000000", "stroke_width": 0, "stroke_color": "#000000", "background_color": "#ffffff", "background_style": "none", "border_width": 0, "border_color": "#000000", "border_style": "none", "shadow": false, "shadow_color": "#000000", "shadow_blur_radius": 0, "shadow_offset_x": 0, "shadow_offset_y": 0, "shadow_spread": 0, "shadow_opacity": 1, "shadow_inset": false, "shadow_composite": "source-over", "shadow_composite_mode": "source-over", "shadow_composite_operator": "source-over", "shadow_composite_operator_mode": "source-over", "shadow_composite_operator_mode_value": "source-over", "shadow_composite_operator_mode_value_type": "string", "shadow_composite_operator_mode_value_type_type": "string", "shadow_composite_operator_mode_value_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type": "string", "shadow_composite_operator_mode_value_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_type_t

Goal Reached Thanks to every supporter — we hit 100%!

Gradio /proxy SSRF Cookie Injection Leading to Cross-Space Session Fixation

More from this source