Access Control Bypass in Hugging Face Hub Allows Unauthorized Access to Private Gated Models
Overview
A serious access control vulnerability was discovered in the Hugging Face Hub platform, specifically affecting private 'gated' repositories. Gated repositories require users to request access and be approved by the repository owner before they can view or download the contents, such as proprietary model weights or datasets. The vulnerability stemmed from an API endpoint responsible for generating pre-signed download URLs for repository files. Researchers found that by manipulating parameters in the API request, it was possible to bypass the access control check that verifies a user's permission to the gated repository. An unauthenticated attacker could craft a specific request for a known private model and receive a valid, short-lived download URL for the model's files. This allowed for the unauthorized exfiltration of sensitive AI models and datasets, potentially exposing valuable intellectual property or private training data. The Hugging Face security team was notified via their bug bounty program and promptly patched the vulnerability on the server side. The issue was caused by a logic flaw in the authorization middleware that failed to properly validate user sessions against repository permissions for this specific API route.
Affected Systems
Testing Guide
1. As this vulnerability was patched server-side, it is no longer possible for external users to test for it directly. 2. To check for potential past compromise, navigate to your private repository's settings on the Hugging Face Hub. 3. Review the access and download logs provided by the platform (if available) for any anomalous download events from unfamiliar IP addresses or user agents prior to the patch date.
Mitigation Steps
1. This was a server-side vulnerability that has been patched by Hugging Face. No direct user action is required to fix the vulnerability itself. 2. **Rotate Tokens:** As a precaution, it is recommended to rotate any Hugging Face access tokens that were active before the patch date. 3. **Review Access Logs:** Owners of private gated repositories should review their repository's access logs for any suspicious or unrecognized download activity during the vulnerability window. 4. **Enable 2FA:** Ensure two-factor authentication is enabled on your Hugging Face account to enhance overall security.
Patch Details
The vulnerability was patched on the Hugging Face Hub's backend infrastructure. The fix was deployed globally and is active for all users.