From 947cf8848e55224276b9fec3a95f436400a9cdb0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:53:09 +0000
Subject: [PATCH] Publish GHSA-r364-m2j9-mf4h

---
 .../2024/03/GHSA-r364-m2j9-mf4h/GHSA-r364-m2j9-mf4h.json      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2024/03/GHSA-r364-m2j9-mf4h/GHSA-r364-m2j9-mf4h.json b/advisories/github-reviewed/2024/03/GHSA-r364-m2j9-mf4h/GHSA-r364-m2j9-mf4h.json
index 969e2f88802..47943d5adf9 100644
--- a/advisories/github-reviewed/2024/03/GHSA-r364-m2j9-mf4h/GHSA-r364-m2j9-mf4h.json
+++ b/advisories/github-reviewed/2024/03/GHSA-r364-m2j9-mf4h/GHSA-r364-m2j9-mf4h.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r364-m2j9-mf4h",
-  "modified": "2024-03-27T21:58:06Z",
+  "modified": "2024-04-16T15:51:15Z",
   "published": "2024-03-27T03:31:16Z",
   "aliases": [
     "CVE-2024-2206"
   ],
   "summary": "gradio Server-Side Request Forgery vulnerability",
-  "details": "The /proxy route allows a user to proxy arbitrary urls including potential internal endpoints.",
+  "details": "An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in requests to the `/` and `/config` routes, allowing the addition of arbitrary URLs for proxying. This flaw enables unauthorized proxying of requests and potential access to internal endpoints within the Hugging Face space. The issue arises from the application's inadequate checking of safe URLs in the `build_proxy_request` function.",
   "severity": [
     {
       "type": "CVSS_V3",