CVE-2024-2206

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in requests to the `/` and `/config` routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the `build_proxy_request` function.

• CWE-918

• https://github.com/gradio-app/gradio/commit/49d9c48537aa706bf72628e3640389470138bdc6Patch
• https://huntr.com/bounties/2286c1ed-b889-45d6-adda-7014ea06d98eExploit, Third Party Advisory
• https://github.com/gradio-app/gradio/commit/49d9c48537aa706bf72628e3640389470138bdc6Patch
• https://huntr.com/bounties/2286c1ed-b889-45d6-adda-7014ea06d98eExploit, Third Party Advisory

Published

Mar 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22051CommonMarker versions prior to 0.23.4 are at risk of an inte…9.8
• CVE-2024-22052A null pointer dereference vulnerability in IPSec component …7.5
• CVE-2024-22053A heap overflow vulnerability in IPSec component of Ivanti C…8.2
• CVE-2024-22054A malformed discovery packet sent by a malicious actor with …7.5
• CVE-2024-22058A buffer overflow allows a low privilege user on the local m…7.8
• CVE-2024-22059A SQL injection vulnerability in web component of Ivanti Neu…8.8
• CVE-2024-22060An unrestricted file upload vulnerability in web component o…4.9
• CVE-2024-22061A Heap Overflow vulnerability in WLInfoRailService component…9.8
• CVE-2024-22062There is a permissions and access control vulnerability in Z…8.8
• CVE-2024-22063The ZENIC ONE R58 products by ZTE Corporation have a command…9
• CVE-2024-22064ZTE ZXUN-ePDG product, which serves as the network node of t…6.5
• CVE-2024-22065There is a command injection vulnerability in ZTE MF258 Pro …8.8