Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

QFinch assessment

A Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses gr.load() to load an attacker-controlled Space, the malicious proxyurl from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure.

Potential impact

Who is impacted: - Any Gradio application that uses gr.load() to load external/untrusted Spaces - HuggingFace Spaces that compose or embed other Spaces - Enterprise deployments where Gradio apps have access to internal networks Attack scenarios: - Cloud credential theft: Access AWS/GCP/Azure metadata endpoints to steal IAM credentials - Internal service access: Reach databases, admin panels, and APIs on private networks - Network reconnaissance: Map internal infrastructure through the victim - Data exfiltration: Access sensitive internal APIs and services

Technical context

The vulnerability exists in Gradio's config processing flow when loading external Spaces: 1. Config Fetching (gradio/external.py:630): gr.load() calls Blocks.fromconfig() which fetches and processes the remote Space's configuration. 2. Proxy URL Trust (gradio/blocks.py:1231-1233): The proxyurl from the untrusted config is added directly to self.proxyurls: 3. Built-in Proxy Route (gradio/routes.py:1029-1031): Every Gradio app automatically exposes a /proxy={urlpath} endpoint: 4. Host-based Validation (gradio/routes.py:365-368): The validation only checks if the URL's host matches any trusted proxyurl host: An attacker can set proxyurl to http://169.254.169.254/ (AWS metadata) or any internal service, and the victim's server will proxy requests to those endpoints.