CVE-2024-48052

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48052
In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 Third Party Advisory
https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
History

13 Jun 2025, 00:21

Type Values Removed Values Added
First Time Gradio Project
Gradio Project gradio
CPE cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
References () https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 - () https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 - Third Party Advisory
References () https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - () https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - Exploit, Third Party Advisory
Information

Published : 2024-11-04 23:15

Updated : 2025-06-13 00:21

NVD link : CVE-2024-48052

Mitre link : CVE-2024-48052

CVE.ORG link : CVE-2024-48052

JSON object : View

Products Affected

gradio_project

  • gradio
CWE
CWE-918

Server-Side Request Forgery (SSRF)