gradio Server Side Request Forgery vulnerability

GHSA-3gf9-wv65-gwh9 · CVE-2024-48052 · PYSEC-2026-1408 · 갱신 2026. 9. 10.

해야 할 일

아직 수정 버전이 없습니다. 원문의 우회 방법을 확인하고 노출 범위를 줄이세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	gradio	없음

원문

gradio Server Side Request Forgery vulnerability

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-48052
WEBhttps://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12
PACKAGEhttps://github.com/gradio-app/gradio
WEBhttps://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4

오늘 목록으로

gradio Server Side Request Forgery vulnerability (GHSA-3gf9-wv65-gwh9) · Sieve