CVE-2024-12070
📋 TL;DR
This vulnerability allows unauthenticated attackers to cause denial of service by sending file upload requests with excessively large filenames to the LLaVA-1.6 server. The server becomes overwhelmed and unresponsive, making it unavailable to legitimate users. Anyone running haotian-liu/llava v1.2.0 (LLaVA-1.6) is affected.
💻 Affected Systems
- haotian-liu/llava
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with the server becoming completely unresponsive, requiring manual intervention to restore service.
Likely Case
Temporary service degradation or outage affecting all users until the malicious requests stop or the server is restarted.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests with large filenames in form-data. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after v1.2.0
Vendor Advisory: https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6
Restart Required: No
Instructions:
1. Update to the latest version of haotian-liu/llava. 2. Verify the fix by checking that filename length validation is implemented in the file upload handler.
🔧 Temporary Workarounds
Implement filename length validation
allAdd server-side validation to reject file uploads with filenames exceeding a reasonable length (e.g., 255 characters).
Implement rate limiting
allAdd rate limiting to the file upload endpoint to prevent mass exploitation attempts.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with rules to block requests containing excessively long filenames.
- Disable the file upload feature entirely if not required for your use case.
🔍 How to Verify
Check if Vulnerable:
Test by sending a file upload request with a filename exceeding 1000 characters and observing if the server becomes unresponsive.Check Version:
Check the software version in your deployment configuration or via the application's version endpoint if available.Verify Fix Applied:
After patching, attempt the same test with a large filename - the request should be rejected with an appropriate error message.📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts with unusually long filenames
- Server error logs showing memory exhaustion or timeout errors
Network Indicators:
- High volume of POST requests to the file upload endpoint
- Requests with Content-Type: multipart/form-data containing extremely long filenames
SIEM Query:
source="web_server" AND (uri="/upload" OR uri="/file-upload") AND filename_length > 1000