Server-Side Request Forgery (SSRF) in gradio-app/gradio

CVE-2024-4325

What is CVE-2024-4325?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Gradio version 4.21.0, specifically within the '/queue/join' endpoint and the 'save_url_to_cache' function. This vulnerability occurs due to improper validation of user-supplied path values, which are intended to be URLs. Attackers can exploit this flaw to send specially crafted HTTP requests, potentially gaining unauthorized access to sensitive internal networks or compromising the security of AWS metadata endpoints. As a result, internal servers' security may be put at risk, making it essential for users to implement stringent validation mechanisms to mitigate such vulnerabilities.

References