CVE-2024-12068
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in haotian-liu/llava allows attackers to make the server send HTTP requests to arbitrary internal URLs. This could expose sensitive server-side resources like AWS metadata credentials or internal APIs. Anyone using the affected version of this software is vulnerable.
💻 Affected Systems
- haotian-liu/llava
📦 What is this software?
Llava by Hliu
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains access to cloud metadata credentials, leading to full cloud environment compromise, data exfiltration, or lateral movement to other internal systems.
Likely Case
Attacker accesses internal APIs or services, potentially stealing sensitive data or using the server as a proxy for further attacks.
If Mitigated
Limited impact due to network segmentation, proper input validation, or outbound firewall rules blocking sensitive endpoints.
🎯 Exploit Status
Exploitation requires understanding of the application's input handling and network access to trigger SSRF.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later git commits after c121f04
Vendor Advisory: https://huntr.com/bounties/9d0b908d-63cd-4d62-91ff-6ceef3183752
Restart Required: No
Instructions:
1. Update to a newer git commit of haotian-liu/llava. 2. Verify the fix by checking the commit hash is after c121f04. 3. Test the application to ensure SSRF vectors are blocked.
🔧 Temporary Workarounds
Input Validation and URL Whitelisting
allImplement strict validation of user-supplied URLs, allowing only trusted domains or blocking internal IP ranges.
Network Segmentation
allUse firewall rules to block outbound requests from the server to sensitive internal endpoints like metadata services.
🧯 If You Can't Patch
- Implement strict outbound firewall rules to block access to internal IP ranges and metadata endpoints.
- Deploy a web application firewall (WAF) with SSRF protection rules to filter malicious requests.
🔍 How to Verify
Check if Vulnerable:
Check the git commit hash of your llava installation; if it is c121f04 or earlier, you are vulnerable.Check Version:
git log --oneline -1Verify Fix Applied:
Update to a newer commit and test by attempting to trigger SSRF with controlled payloads; requests to internal URLs should be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the server to internal IPs or metadata endpoints
- Failed attempts to access restricted URLs
Network Indicators:
- Outbound connections from the server to unexpected internal services
- Traffic to cloud metadata endpoints (e.g., 169.254.169.254 for AWS)
SIEM Query:
source="llava_logs" AND (url CONTAINS "169.254.169.254" OR url CONTAINS "metadata")