CVE-2024-2206
Assigner: @huntr_ai
Published: 2024-03-27T00:00:32.469Z
State: PUBLISHED
title: SSRF Vulnerability in gradio-app/gradio
descriptions: value: An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in requests to the `/` and `/config` routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the `build_proxy_request` function.
affected: vendor: gradio-app
product: gradio-app/gradio
versions: version: unspecified
lessThan: 4.18
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseScore: 7.3
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-918 Server-Side Request Forgery (SSRF)
cweId: CWE-918
source: advisory: 2286c1ed-b889-45d6-adda-7014ea06d98e
discovery: EXTERNAL