CVE-2024-4325

HIGHNuclei

Server-Side Request Forgery (SSRF) in gradio-app/gradio

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-4325 has a selected CVSS score of 8.6 (high); EIP currently links 1 Nuclei template.

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 25, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 6, 2024 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

gradio-app/gradio

Browse gradio-app / gradio-app/gradio
CVE ListThrough latestaffected

gradio

Browse gradio.app / gradio
VulnCheckVersion data not supplied

gradio

Browse gradio_project / gradio

Default status: unknown

CVE ListThrough 4.21.0affected

gradio

Browse PyPI / gradio
GitHub AdvisoryThrough 4.36.0affected

Nuclei templates

1
ProjectDiscoveryHIGHGradio - Server-Side Request ForgeryCVSS 8.6

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.

Impact

Unauthenticated attackers can force the server to make arbitrary requests via SSRF, potentially accessing internal services and cloud metadata endpoints.

Remediation

Update Gradio to a version later than 4.21.0 that patches the SSRF vulnerability.

WeaknessesCWE-918
Authorsiamnoooob, pdresearch
Template tagscvecve2024gradiossrfcloudoastvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CPE: cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
Shodan: http.html:"__gradio_mode__"
Shodan: http.title:"gradio"
FOFA: body="__gradio_mode__"
FOFA: title="gradio"
Google: intitle:"gradio"
https://github.com/advisories/GHSA-973g-55hp-3frw https://nvd.nist.gov/vuln/detail/CVE-2024-4325

Source: ProjectDiscovery

References

4