Improper Authorization

Summary

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the 'localhost_aliases' variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. As a workaround, users can manually modify the 'localhost_aliases' list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation. This issue affects gradio versions prior to 5.0.0b1.