gradio-exploit

Gradio exploit skill

Gradio is a Python machine learning model web demo framework, widely used for HuggingFace Spaces. This skill covers LFI and SSRF exploitation methods for the Gradio component server attack surface.

Target information

Default port：7860
Fingerprinting: page contains __gradio_mode__、gradio-app、content="gradio"
Shodan：html:"__gradio_mode__"
Key endpoints：/component_server、/queue/join、/file=

Vulnerability overview

CVE/type	Vulnerability	Authentication	Impact	Harm	Version
CVE-2024-47167	LFI	Not required	Arbitrary file read	High risk	3.47-3.50.2
Same-origin SSRF	Full-read SSRF	Not required	Internal network probing + data read	High risk	3.47-3.50.2
queue/join SSRF	File proxy SSRF	Not required	Internal network resource proxy read	High risk	~4.40.0

Attack path decision tree

目标: TARGET:7860
  |
  +-- 检测到 /component_server 端点?
  |     +-- 是 -> 版本 3.47-3.50.2
  |     |     +-- LFI: fn_name=make_temp_copy_if_needed, data=本地路径
  |     |     +-- SSRF: fn_name=download_temp_copy_if_needed, data=URL
  |     |
  |     +-- 否 -> 可能是 4.x 版本
  |           +-- 检测 /queue/join 端点
  |           +-- 寻找 File/URL 输入组件
  |           +-- SSRF: data=[{"path": "URL"}], fn_index=0
  |
  +-- 两个端点都不可用?
        +-- 可能已修补或需要认证

Vulnerability detection priority

Priority	Type	Detection method	Judgment
P0	CVE-2024-47167 LFI	POST /component_server + make_temp_copy_if_needed	Returned path can be downloaded
P0	component_server SSRF	POST /component_server + download_temp_copy_if_needed	Returned cache path can be read
P1	queue/join SSRF	POST /queue/join + File URL input	Proxy to /tmp/gradio/

Notes

component_id Bruteforcing is a necessary step, usually 0-20 is enough to cover
The queue/join SSRF cache path is calculated using SHA1(URL) and can be predicted directly
If Gradio has authentication enabled, these vulnerabilities may not be exploitable

About this skill