CVE-2024-48052: gradio Server Side Request Forgery vulnerability

November 5, 2024 (updated November 7, 2024)

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

References

gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12
github.com/advisories/GHSA-3gf9-wv65-gwh9
github.com/gradio-app/gradio
nvd.nist.gov/vuln/detail/CVE-2024-48052
rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4

Code Behaviors & Features

Detect and mitigate CVE-2024-48052 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →