Server-Side Request Forgery (SSRF) in gradio-app/gradio

CVE-2024-4325

What is CVE-2024-4325?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Gradio version 4.21.0, specifically within the '/queue/join' endpoint and the 'save_url_to_cache' function. This vulnerability occurs due to improper validation of user-supplied path values, which are intended to be URLs. Attackers can exploit this flaw to send specially crafted HTTP requests, potentially gaining unauthorized access to sensitive internal networks or compromising the security of AWS metadata endpoints. As a result, internal servers' security may be put at risk, making it essential for users to implement stringent validation mechanisms to mitigate such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References