CVE-2024-8021: Gradio Open Redirect Vulnerability

CVE-2024-8021 Overview

CVE-2024-8021 is an open redirect vulnerability [CWE-601] affecting the gradio-app/gradio framework, an open-source Python library for building machine learning web interfaces. The flaw allows attackers to redirect users to attacker-controlled destinations by supplying URL-encoded payloads in redirect parameters. A crafted request causes the application to respond with an HTTP 302 redirect pointing to the malicious location. Attackers commonly weaponize open redirects in phishing campaigns, credential harvesting, and OAuth token theft workflows.

Critical Impact
Attackers can abuse the trusted Gradio-hosted domain to redirect users to malicious websites, enabling phishing and credential theft against ML application users.

Affected Products

gradio_project:gradio (Python package)
Gradio deployments exposed over the network
ML applications and Hugging Face Spaces built on Gradio

Discovery Timeline

2025-03-20 - CVE-2024-8021 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8021

Vulnerability Analysis

The vulnerability resides in Gradio's HTTP redirect handling logic. The application accepts a user-supplied destination value and issues an HTTP 302 response without validating whether the target belongs to an allowed domain. URL encoding bypasses any weak string filtering that may exist. This is a classic URL Redirection to Untrusted Site vulnerability tracked under CWE-601.

Exploitation requires user interaction, since a victim must click a crafted link. However, the link originates from the trusted Gradio application host, so security awareness cues that rely on domain inspection fail. The attack surface expands significantly when Gradio applications are embedded in enterprise ML workflows or published on shared hosting platforms.

An EPSS score of 0.744% reflects moderate near-term exploitation likelihood relative to other public CVEs.

Root Cause

The root cause is missing or insufficient validation of redirect target URLs. The application decodes user-provided input and passes it directly into a redirect response header. No allowlist check confirms that the resolved destination points to an approved origin.

Attack Vector

An unauthenticated remote attacker crafts a URL against a legitimate Gradio deployment. The URL contains a URL-encoded redirect parameter pointing to an attacker-controlled domain. The attacker distributes the link through email, chat, or social platforms. When the victim clicks, the Gradio server issues a 302 response that forwards the browser to the malicious site. The destination site can then present a spoofed login page or deliver drive-by content.

Refer to the Huntr Security Bounty disclosure for the disclosed proof-of-concept parameters.

Detection Methods for CVE-2024-8021

Indicators of Compromise

HTTP 302 responses from Gradio endpoints where the Location header points to an external, non-allowlisted domain.
Access logs containing URL-encoded http%3A%2F%2F or https%3A%2F%2F substrings in query parameters.
Spikes in short-lived sessions that terminate immediately after a redirect response.

Detection Strategies

Parse web server access logs for redirect responses where the destination host does not match the application's canonical hostname.
Deploy web application firewall (WAF) rules that inspect and decode query parameters containing URL-like values.
Correlate outbound DNS lookups from user endpoints with recent Gradio referrers to identify successful redirect chains.

Monitoring Recommendations

Enable verbose HTTP logging on Gradio reverse proxies to capture full request URIs and response Location headers.
Alert on any redirect target whose registered domain differs from the Gradio host.
Monitor threat intelligence feeds for phishing kits abusing Gradio or Hugging Face Spaces domains.

How to Mitigate CVE-2024-8021

Immediate Actions Required

Upgrade Gradio to the latest patched release published after March 2025.
Audit deployed Gradio applications for exposed redirect endpoints and disable unused routes.
Notify users of the risk of clicking redirect links that pass through Gradio hosts until patching completes.

Patch Information

The Gradio maintainers addressed the issue in a subsequent release following coordinated disclosure through the Huntr bug bounty platform. Consult the Huntr Security Bounty entry for the referenced commit and version details, then upgrade via pip install --upgrade gradio.

Workarounds

Place Gradio behind a reverse proxy that enforces a redirect allowlist limited to the application's own domain.
Strip or reject query parameters containing URL-encoded protocol schemes at the proxy layer.
Apply Content Security Policy (CSP) headers to constrain navigation targets where feasible.

bash

# Nginx reverse proxy example: block requests carrying encoded external URLs
location / {
    if ($args ~* "(https?%3[aA]%2[fF]%2[fF]|https?://)") {
        return 400;
    }
    proxy_pass http://gradio_backend;
}