CVE-2024-11031

Executive Summary

CVE-2024-11031 is a Server-Side Request Forgery (SSRF) vulnerability in binary-husky/gpt_academic version 3.83. The flaw resides in the Markdown_Translate.get_files_from_everything() API, specifically within the HotReload (Markdown翻译中) plugin function. The vulnerability allows an attacker to force the Gradio web server to make arbitrary HTTP requests to internal or external hosts, bypassing a weak validation that only checks if the URL starts with http. This can lead to unauthorized access to internal resources, credential theft, and lateral movement within the victim's network.

The vulnerability is classified as high severity (CVSS 7.7) due to the ease of exploitation (no authentication required) and the potential for significant information disclosure. No official patch has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a Python-based open-source project (gpt_academic) distributed via GitHub and potentially PyPI. The supply chain risk is elevated because:

• Dependency Chain: The project relies on Gradio, a popular Python web framework. While Gradio itself is not vulnerable, the custom plugin code introduces the SSRF flaw.
• No Patch Available: The absence of a patch means users must manually apply mitigations or fork the repository.
• Widespread Use: gpt_academic is used in academic and research environments, often deployed with default configurations, increasing the attack surface.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Potential to read internal files and credentials.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The SSRF can be weaponized to scan internal networks, access cloud metadata endpoints (e.g., AWS 169.254.169.254), and steal Gradio authentication tokens.

Deep Dive & Mechanics

The vulnerability is triggered via the HotReload plugin's Markdown_Translate.get_files_from_everything() function. The code performs a superficial check to ensure the user-supplied URL starts with http or https, but does not validate the host or path. This allows an attacker to craft a request like:

POST /api/hot_reload HTTP/1.1
Host: victim-gradio-server:7860
Content-Type: application/json

{
  "url": "http://169.254.169.254/latest/meta-data/"
}

The server then makes an outbound request to the specified URL, returning the response to the attacker. The lack of host allowlisting or protocol restrictions enables SSRF to internal services (e.g., Redis, databases) and cloud metadata endpoints.

Key Weaknesses:

1. Insufficient URL Validation: Only checks for http prefix.
2. No Host Allowlist: Any IP or domain is permitted.
3. No Rate Limiting: Multiple requests can be made in rapid succession.
4. Plugin Architecture: The HotReload plugin is enabled by default in many deployments.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.83):

# In Markdown_Translate.py
def get_files_from_everything(self, url):
    if not url.startswith('http'):
        raise ValueError("Invalid URL")
    response = requests.get(url, timeout=10)
    return response.text

Patched Code (hypothetical fix):

# In Markdown_Translate.py
import re
from urllib.parse import urlparse

ALLOWED_HOSTS = ['localhost', '127.0.0.1', '*.trusted-domain.com']

def get_files_from_everything(self, url):
    parsed = urlparse(url)
    if parsed.scheme not in ['http', 'https']:
        raise ValueError("Invalid scheme")
    host = parsed.hostname
    if not any(host == allowed or (allowed.startswith('*.') and host.endswith(allowed[1:])) for allowed in ALLOWED_HOSTS):
        raise ValueError("Host not allowed")
    response = requests.get(url, timeout=10)
    return response.text

The patched version adds proper URL parsing, scheme validation, and a host allowlist to prevent SSRF.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of gpt_academic version 3.83 with Gradio exposed on port 7860.
• Network access to the target.

Exploitation Steps:

1. Identify the endpoint: The vulnerable API is typically at /api/hot_reload or directly via the Gradio interface.
2. Craft a malicious request: Use curl or a script to send a POST request with a JSON body containing the target URL.

curl -X POST http://target:7860/api/hot_reload \
  -H "Content-Type: application/json" \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

3. Extract sensitive data: The response will contain the cloud metadata, including IAM credentials if on AWS.

Advanced Exploitation:

• Internal Port Scanning: Use the SSRF to scan internal IP ranges (e.g., http://192.168.1.1:22).
• Credential Theft: Access Gradio's authentication tokens stored in environment variables or files (e.g., file:///proc/self/environ).
• Pivot to Other Services: Use the SSRF to interact with internal Redis, MySQL, or other services.

Blue Team

Detection Steps:

1. Monitor Outbound Connections: Look for unexpected outbound HTTP requests from the Gradio server to internal IPs or cloud metadata endpoints.
2. Analyze Logs: Check Gradio access logs for requests to /api/hot_reload with suspicious url parameters.
3. Network Segmentation: Ensure the Gradio server is isolated from sensitive internal networks.

Honeypot Setup:

• Deploy a fake metadata endpoint (e.g., http://169.254.169.254) that logs all requests and alerts on access.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_11031_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against gpt_academic CVE-2024-11031"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-11031"
    strings:
        $s1 = "/api/hot_reload" ascii wide nocase
        $s2 = "get_files_from_everything" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide
        $s4 = "metadata" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-11031 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against gpt_academic HotReload plugin
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/hot_reload'
        cs-uri-query|contains: 'url=http'
    condition: selection
falsepositives:
    - Legitimate use of HotReload with external URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11031 SSRF Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/hot_reload"; http_uri; content:"url=http"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HotReload Plugin: Remove or disable the Markdown_Translate plugin in the configuration.
2. Network Segmentation: Place the Gradio server behind a firewall that blocks outbound connections to internal IPs and cloud metadata endpoints.
3. Apply WAF Rules: Use a Web Application Firewall to block requests containing url=http://169.254.169.254 or similar patterns.

Long-Term Fix:

• Patch the Code: Implement proper URL validation with a host allowlist as shown in the patched code example.
• Upgrade Gradio: Ensure Gradio is updated to the latest version to benefit from any security improvements.
• Monitor for Updates: Watch the official GitHub repository for a security patch.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.