BentoML v1.3.9 - Open Redirect

id: CVE-2024-12760

info:
  name: BentoML v1.3.9 - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    An open redirect vulnerability exists in BentoML v1.3.9, where the file parameter in the /ui/gradio_api/file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.
  impact: |
    Unauthenticated attackers can redirect users to malicious URLs via the file parameter, facilitating phishing attacks.
  remediation: |
    Update BentoML to a version newer than v1.3.9.
  reference:
    - https://huntr.com/bounties/2a284ff6-cc6c-4a10-b72e-1bb31c842bca
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"BentoML"
  tags: cve,cve2024,gradio,redirect,oss,bentoml,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ui/gradio_api/file=https://oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'
# digest: 4b0a00483046022100ce43d8fc16880f3f410a7a48bc9bfe0c6c98263bb652b7d0dbb9ff75d7ab61cb022100b5d4f7c21b39f1c316693fd84619d56dade0ceb5f60d2fff29a914eaeb0c571f:922c64590222798bb761d5b6d8e72950