PT-2024-32450 · Gradio · Gradio
Ahpaleus
+1
·
Published
2024-10-10
·
Updated
2024-10-17
·
CVE-2024-47167
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Gradio versions prior to 5
Description
This issue relates to Server-Side Request Forgery (SSRF) in the "/queue/join" endpoint. Gradio’s
async save url to cache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable attackers to target internal servers or services within a local network and possibly exfiltrate data or cause unwanted internal requests. The content from these URLs is stored locally, making it easier for attackers to upload potentially malicious files to the server. This impacts users deploying Gradio servers that use components like the Video component which involve URL fetching.Recommendations
To address this issue, upgrade to
gradio>=5.
As a temporary workaround, consider disabling or heavily restricting URL-based inputs in Gradio applications to trusted domains only.
Additionally, implementing stricter URL validation (such as allowlist-based validation) and ensuring that local or internal network addresses cannot be requested via the "/queue/join" endpoint can help mitigate the risk of SSRF attacks.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gradio