CVE-2024-4325: Gradio Project Gradio SSRF Vulnerability

CVE-2024-4325 Overview

CVE-2024-4325 is a Server-Side Request Forgery (SSRF) vulnerability in gradio-app/gradio version 4.21.0. The flaw resides in the /queue/join endpoint and the save_url_to_cache function. The function accepts a user-supplied path value and issues an HTTP request without validating that the URL targets an external resource. Attackers can craft requests that force the Gradio server to reach internal network hosts or the AWS instance metadata service. The issue is tracked as CWE-918 and reported through the Huntr Bounty Report.

Critical Impact
Unauthenticated attackers can pivot through the Gradio server to access internal services and cloud metadata endpoints, exposing credentials and internal infrastructure.

Affected Products

gradio-app/gradio version 4.21.0
Python deployments of Gradio exposing the /queue/join endpoint
Hosted Gradio applications running on cloud providers with reachable metadata services

Discovery Timeline

2024-06-06 - CVE-2024-4325 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4325

Vulnerability Analysis

Gradio exposes the /queue/join endpoint to coordinate inference requests submitted by users. The endpoint forwards file-like inputs to the save_url_to_cache function, which downloads remote resources for later processing. The function trusts the path field supplied in the request body and uses it directly as the target of an outbound HTTP request. No allowlist, scheme filter, or DNS rebinding protection restricts the destination.

An attacker submits a path that points to an internal hostname, a loopback address, or a cloud metadata endpoint such as 169.254.169.254. The Gradio server performs the request from its own network position and returns or caches the response. This grants the attacker indirect access to resources that are not exposed to the public internet.

Root Cause

The root cause is missing input validation on the path parameter consumed by save_url_to_cache. The function treats any user-controlled string as a safe URL and issues the request without verifying the scheme, resolved IP address, or destination port. This pattern matches the SSRF weakness class defined in CWE-918.

Attack Vector

Exploitation requires only network access to the Gradio application. The attacker sends a crafted POST request to /queue/join containing a path value pointing at an internal target. Common targets include the AWS Instance Metadata Service for temporary IAM credentials, internal admin panels, and private APIs that trust network-local callers. No authentication or user interaction is required.

The vulnerability mechanism is described in the public Huntr Bounty Report. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2024-4325

Indicators of Compromise

Outbound HTTP requests from the Gradio process to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254
/queue/join requests containing path values that reference internal hostnames, loopback addresses, or metadata IPs
Unexpected reads of IAM role credentials from cloud audit logs originating from the Gradio host

Detection Strategies

Inspect web access logs for POST requests to /queue/join and parse the path field for non-public destinations
Correlate Gradio process network connections with internal subnet ranges using egress monitoring
Alert on access to http://169.254.169.254/latest/meta-data/ originating from application workloads

Monitoring Recommendations

Enable VPC flow logs and CloudTrail in AWS environments hosting Gradio to capture metadata service access
Forward Gradio application logs to a centralized SIEM for correlation with network telemetry
Track outbound DNS resolutions from the Gradio host for unusual internal lookups

How to Mitigate CVE-2024-4325

Immediate Actions Required

Upgrade Gradio to a version later than 4.21.0 that includes URL validation in save_url_to_cache
Restrict egress from Gradio hosts so they cannot reach internal subnets or cloud metadata IPs
Enforce IMDSv2 with hop limit 1 on AWS EC2 instances running Gradio to block SSRF-based credential theft

Patch Information

Upgrade to a fixed release of gradio published after version 4.21.0. Review the Huntr Bounty Report for the disclosed fix details and confirm the deployed version no longer permits arbitrary URLs in save_url_to_cache.

Workarounds

Place Gradio behind a reverse proxy that strips or validates the path field on /queue/join requests
Deploy Gradio in a network segment with no route to internal services or metadata endpoints
Apply an egress firewall policy that denies traffic to 169.254.169.254 and RFC1918 ranges from the Gradio workload

bash

# Example AWS IMDSv2 enforcement to reduce SSRF impact
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled