CVE-2024-48052: Gradio: SSRF in DownloadButton exposes internal resources

GHSA-3gf9-wv65-gwh9MEDIUMPoC AVAILABLECISA: TRACK*

Published November 4, 2024

CISO Take

Any Gradio deployment ≤4.42.0 with gr.DownloadButton can be abused by low-privileged users to pivot to internal services and cloud metadata endpoints — AWS/GCP IAM credential theft is a realistic one-step escalation. Gradio is ubiquitous on HuggingFace Spaces and internal ML platforms, making real-world exposure far wider than CVSS suggests. Patch immediately and enforce IMDSv2 on all cloud hosts running Gradio.

What is the risk?

Despite a medium CVSS (6.5), real-world risk is elevated for AI/ML environments. Exploitation requires only low privileges and no user interaction over the network — effectively any authenticated visitor of a Gradio app qualifies. Cloud-hosted ML demo stacks (HuggingFace Spaces, internal serving portals) have direct access to IMDS endpoints, making SSRF → IAM credential theft a near-trivial one-step attack. EPSS of 0.00092 reflects current observed exploitation activity, not the inherent exploitability of this class of vulnerability.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gradio	pip	—	No patch
43.9KOpenSSF 5.9735 dependentsPushed 6d ago29% patched~108d to patchFull package profile →
Gradio	pip	<= 4.42.0	No patch
43.9KOpenSSF 5.9735 dependentsPushed 6d ago29% patched~108d to patchFull package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

5 steps

Patch: Upgrade to Gradio >4.42.0 — verify patched version on PyPI before deploying.
Workaround (if upgrade blocked): Remove or disable all gr.DownloadButton components from public-facing interfaces.
Network egress control: Block outbound HTTP from Gradio server processes to 169.254.169.254, 169.254.170.2, 100.100.100.200, and RFC1918 ranges at the host or container level.
IMDSv2 enforcement: Enable IMDSv2 (hop-limit=1) on all AWS EC2/ECS instances running Gradio to block SSRF-based metadata enumeration.
Detection: Alert on outbound HTTP requests from Gradio processes targeting internal or metadata IPs; monitor server logs for download requests containing internal URL patterns (10.x, 172.16-31.x, 192.168.x, 169.254.x).

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionPrivacy ViolationFrameworkInferenceAML.T0025- Exfiltration via Cyber Means AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.4-System and application access control

NIST AI RMF

MANAGE 2.2-Mechanisms are in place to sustain the value of deployed AI systems and trustworthiness of their operations

OWASP LLM Top 10

LLM03:2025-Supply Chain

Frequently Asked Questions

What is CVE-2024-48052?

Is CVE-2024-48052 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-48052, increasing the risk of exploitation.

How to fix CVE-2024-48052?

1. Patch: Upgrade to Gradio >4.42.0 — verify patched version on PyPI before deploying. 2. Workaround (if upgrade blocked): Remove or disable all gr.DownloadButton components from public-facing interfaces. 3. Network egress control: Block outbound HTTP from Gradio server processes to 169.254.169.254, 169.254.170.2, 100.100.100.200, and RFC1918 ranges at the host or container level. 4. IMDSv2 enforcement: Enable IMDSv2 (hop-limit=1) on all AWS EC2/ECS instances running Gradio to block SSRF-based metadata enumeration. 5. Detection: Alert on outbound HTTP requests from Gradio processes targeting internal or metadata IPs; monitor server logs for download requests containing internal URL patterns (10.x, 172.16-31.x, 192.168.x, 169.254.x).

What systems are affected by CVE-2024-48052?

This vulnerability affects the following AI/ML architecture patterns: model serving, ML demo platforms, training pipelines.

What is the CVSS score for CVE-2024-48052?

CVE-2024-48052 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

model servingML demo platformstraining pipelines

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

Exploitation Scenario

An attacker with a free or trial account on any HuggingFace Space running Gradio ≤4.42.0 interacts with a gr.DownloadButton and submits the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/[role-name]. The Gradio server fetches this URL server-side via save_url_to_cache without any restriction, caches the response, and returns it to the attacker — yielding valid AWS IAM access keys and session tokens. The attacker then uses these credentials to enumerate and exfiltrate S3 buckets containing proprietary training datasets, fine-tuned model weights, and customer data. On GCP or Azure deployments, equivalent metadata endpoints yield comparable tokens. No AI/ML knowledge required; standard SSRF payloads apply directly.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.