Description
Gradio 是由 Hugging Face 开发的开源 Python 库，专为机器学习工程师和数据科学家设计，用于快速构建和分享机器学习模型的交互式 Web 演示界面。该平台广泛应用于 AI 模型展示、原型验证和学术研究场景，支持图像、文本、音频等多种输入输出类型。Gradio /proxy 接口存在服务器端请求伪造漏洞，攻击者可使服务器向任意地址发起 HTTP 请求。
Gradio /proxy 服务器端请求伪造漏洞（CVE-2023-34239）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-34239
https://github.com/gradio-app/gradio/security/advisories/GHSA-3qqg-pgqq-3695
https://horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/
https://access.redhat.com/security/cve/cve-2023-34239
https://www.sentinelone.com/vulnerability-database/cve-2023-34239/
https://advisories.gitlab.com/pypi/gradio/CVE-2023-34239/
https://www.redpacketsecurity.com/gradio-security-bypass-cve-2023-34239/