An open redirect vulnerability exists in BentoML v1.3.9, where the file parameter in the /ui/gradio_api/file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.
id: bentoml-open-redirect
info:
name: BentoML v1.3.9 - Open Redirect
author: DhiyaneshDK
severity: medium
description: |
An open redirect vulnerability exists in BentoML v1.3.9, where the file parameter in the /ui/gradio_api/file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs.
impact: |
Unauthenticated attackers can redirect users to malicious URLs via the file parameter, facilitating phishing attacks.
remediation: |
Update BentoML to a version newer than v1.3.9.
reference:
- https://huntr.com/bounties/2a284ff6-cc6c-4a10-b72e-1bb31c842bca
metadata:
verified: true
max-request: 1
shodan-query: html:"BentoML"
tags: gradio,redirect,oss,bentoml,vuln
http:
- method: GET
path:
- "{{BaseURL}}/ui/gradio_api/file=https://oast.me"
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'
# digest: 4a0a00473045022100837c8ee2e25c86f45d12c398078b4abf73de3c7e397410b654fb95201f05597d02204476b9576da21f34c8adb7713e6aa8d1e5b185a5745b5b9631abbd19dccb515d:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.