GHSA-3gf9-wv65-gwh9

gradio Server Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-48052

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	gradio	<= 4.42.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-48052 advisory
https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 web
https://github.com/gradio-app/gradio package
https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 web