An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in requests to the `/` and `/config` routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the `build_proxy_request` function.
References
Configurations
No configuration.
History
21 Nov 2024, 09:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gradio-app/gradio/commit/49d9c48537aa706bf72628e3640389470138bdc6 - | |
| References | () https://huntr.com/bounties/2286c1ed-b889-45d6-adda-7014ea06d98e - |
16 Apr 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in requests to the `/` and `/config` routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the `build_proxy_request` function. |
27 Mar 2024, 12:29
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
27 Mar 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-27 01:15
Updated : 2024-11-21 09:09
NVD link : CVE-2024-2206
Mitre link : CVE-2024-2206
CVE.ORG link : CVE-2024-2206
JSON object : View
Products Affected
No product.
CWE
CWE-918
Server-Side Request Forgery (SSRF)