CVE-2024-12375
📋 TL;DR
A local file inclusion vulnerability in automatic1111/stable-diffusion-webui allows attackers to read arbitrary files on the system by sending specially crafted requests. This affects users running version git 82a973c of the web interface for Stable Diffusion.
💻 Affected Systems
- automatic1111/stable-diffusion-webui
📦 What is this software?
Stable Diffusion Webui by Automatic1111
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like SSH keys, configuration files, or password databases, potentially leading to privilege escalation or lateral movement.
Likely Case
Exfiltration of sensitive application configuration files, user data, or system information that could enable further attacks.
If Mitigated
Limited information disclosure if proper file permissions and network segmentation are implemented.
🎯 Exploit Status
The vulnerability is publicly documented with proof-of-concept available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later git commits after 82a973c
Vendor Advisory: https://huntr.com/bounties/21952043-395f-4cd3-9374-b73ab9612f27
Restart Required: Yes
Instructions:
1. Update to the latest version of stable-diffusion-webui using 'git pull' in the installation directory. 2. Restart the webui service. 3. Verify the fix by checking that the vulnerable commit is no longer present.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the webui to trusted IP addresses only
Use firewall rules to limit access: ufw allow from TRUSTED_IP to any port 7860
Run as Unprivileged User
allRun the webui with minimal file system permissions
sudo -u webui_user python launch.py
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to the vulnerable service
- Apply file system permissions to restrict the webui process from accessing sensitive directories
🔍 How to Verify
Check if Vulnerable:
Check git commit hash: cd /path/to/stable-diffusion-webui && git log --oneline -1Check Version:
cd /path/to/stable-diffusion-webui && git log --oneline -1Verify Fix Applied:
Verify current commit is not 82a973c and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file path requests in web server logs
- Patterns of '../' sequences in URL parameters
Network Indicators:
- HTTP requests with path traversal sequences targeting the vulnerable endpoint
SIEM Query:
source="webui_access.log" AND (url="*../*" OR url="*/..*" OR url="*file=*" OR url="*path=*")