CVE-2024-4325

描述

A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio and was discovered in version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.

如何修補 CVE-2024-4325

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本
• —未列出修補版本

CVE-2024-4325 正在被利用嗎?

中等 — EPSS 為 37.4%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, <= 4.36.0
• from 0, <= 4.36.0

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-973g-55hp-3frw
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-4325
• PATCHgithub.com/gradio-app/gradio
• PATCHpypi.org/project/gradio
• WEBgithub.com/gradio-app/gradio/pull/8301