CVE-2024-4325 in the critical feed json
Server-Side Request Forgery (SSRF) in gradio-app/gradio
published 2024-06-06 2 y ago modified 2026-09-10 1 mo ago also GHSA-973g-55hp-3frw , PYSEC-2026-1413 , EUVD-2024-1995
- cvss
- 8.6
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 37.1%
- EPSS 37.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
37.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Gradio - Server-Side Request Forgery nuclei detection template
- huntr.com https://huntr.com/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.0 | 8.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| OSV | 3.0 | 8.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gradio | <=4.36.0 |
no fix listed |
Affected products
- gradio-app gradio-app/gradio
- gradio_project gradio
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/gradio-app/gradio/pull/8301
web
-
huntr.com
/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-4325
advisory
-
github.com
/gradio-app/gradio
package
-
pypi.org
/project/gradio
package
-
github.com
/advisories/GHSA-973g-55hp-3frw
advisory
Sources
- CVE List CVE-2024-4325
- GitHub Advisory GHSA-973g-55hp-3frw
- NVD CVE-2024-4325
- OSV PYSEC-2026-1413
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.