CVE-2024-1183: Gradio SSRF Vulnerability Exploit

CVE-2024-1183 Overview

CVE-2024-1183 is a Server-Side Request Forgery (SSRF) vulnerability in the gradio-app/gradio repository, a popular Python framework for building machine learning web interfaces. Attackers can abuse the file parameter in a GET request to probe internal network resources. The server's differential responses, specifically the presence of a Location header for reachable hosts versus a File not allowed error, let an attacker enumerate open ports behind the Gradio deployment. The flaw is tracked under CWE-601 (URL Redirection to Untrusted Site) and affects Gradio installations exposed to untrusted users.

Critical Impact

Attackers can map internal network topology and identify reachable services behind the Gradio host, enabling follow-on attacks against otherwise unreachable systems.

Affected Products

• Gradio (gradio-app/gradio) Python package
• Gradio deployments exposing the /file= route to unauthenticated or low-privileged users
• Machine learning applications built on vulnerable Gradio versions prior to the patched commit

Discovery Timeline

• 2024-04-16 - CVE-2024-1183 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-1183

Vulnerability Analysis

The vulnerability lives in Gradio's file-serving route handler. When a client requests /file={path_or_url}, the server inspects the parameter and, if it is treated as a URL, issues an HTTP redirect using RedirectResponse with status 302. The original URL validation routine (utils.validate_url) accepted inputs that let an attacker coerce Gradio into reflecting arbitrary host and port combinations through the redirect machinery. By observing whether the response contains a Location header or a File not allowed error, an attacker infers the reachability of internal hosts and ports. This turns a benign file-serving endpoint into a reconnaissance primitive for the internal network.

Root Cause

The root cause is permissive URL validation in gradio/routes.py. The pre-patch logic treated too many string patterns as valid URLs and did not restrict destinations to safe schemes or external hosts, allowing attackers to reference internal addresses such as 127.0.0.1:22 or RFC1918 ranges.

Attack Vector

Exploitation requires only network access to the Gradio application and a crafted GET request. User interaction is required because the attack is typically delivered through a victim loading an attacker-controlled URL that triggers the request. The vulnerability does not grant code execution, but it reveals confidential network topology information.

        @app.get("/file={path_or_url:path}", dependencies=[Depends(login_check)])
        async def file(path_or_url: str, request: fastapi.Request):
            blocks = app.get_blocks()
-            if utils.validate_url(path_or_url):
+            if client_utils.is_http_url_like(path_or_url):
                return RedirectResponse(
                    url=path_or_url, status_code=status.HTTP_302_FOUND
                )

Source: gradio-app/gradio commit 2ad3d9e. The patch replaces utils.validate_url with the stricter client_utils.is_http_url_like helper so that only well-formed HTTP(S) URLs trigger the redirect path.

Detection Methods for CVE-2024-1183

Indicators of Compromise

• Repeated GET requests to /file= with values pointing at internal IP ranges such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
• Bursts of /file= requests cycling through sequential port numbers from a single source address.
• HTTP 302 responses from the Gradio service with Location headers pointing at internal hosts.

Detection Strategies

• Parse Gradio access logs for /file= requests whose path parameter resolves to private or loopback addresses.
• Alert on anomalous ratios of 302 responses versus File not allowed errors from the Gradio endpoint over short time windows.
• Correlate requests to the /file= route with downstream connection attempts from the Gradio host to unusual internal services.

Monitoring Recommendations

• Enable verbose request logging on the reverse proxy fronting Gradio and retain full URL parameters for forensic review.
• Monitor outbound traffic from Gradio hosts and alert when connections target management ports such as 22, 3306, 6379, or cloud metadata endpoints like 169.254.169.254.
• Baseline normal request patterns for the /file= endpoint and alert on deviations in volume or destination diversity.

How to Mitigate CVE-2024-1183

Immediate Actions Required

• Upgrade Gradio to a version that includes commit 2ad3d9e7ec6c8eeea59774265b44f11df7394bb4 or later.
• Restrict access to Gradio applications with authentication and network segmentation where feasible.
• Audit historical access logs for prior exploitation attempts targeting the /file= route.

Patch Information

The fix is published in the upstream repository as commit 2ad3d9e. It replaces the permissive utils.validate_url check with client_utils.is_http_url_like, which only matches well-formed HTTP and HTTPS URLs. Additional context is available in the Huntr bounty listing.

Workarounds

• Place Gradio behind a reverse proxy that blocks requests to /file= containing private, loopback, or link-local addresses.
• Enforce an egress firewall on the Gradio host that denies outbound traffic to internal management interfaces and cloud metadata services.
• Require authentication on all Gradio routes using the auth parameter so unauthenticated users cannot reach the vulnerable handler.

# Nginx snippet to block SSRF probes against the Gradio /file= endpoint
location ~ ^/file=(https?://)?(127\.|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.) {
    return 403;
}