CVE-2024-2029
📋 TL;DR
This CVE describes a command injection vulnerability in mudler/localai's TranscriptEndpoint that allows attackers to execute arbitrary commands on the host system by exploiting improper filename sanitization in the audioToWav function. The vulnerability affects systems running vulnerable versions of localai that process audio files for transcription. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- mudler/localai
📦 What is this software?
Localai by Mudler
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, data exfiltration, lateral movement within the network, and persistent backdoor installation.
Likely Case
Unauthorized command execution with the privileges of the localai process, potentially leading to data theft, service disruption, or cryptocurrency mining.
If Mitigated
Limited impact if the process runs with minimal privileges, network segmentation is enforced, and input validation prevents exploitation.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available proof-of-concept code. No authentication is required to trigger the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 31a4c9c9d3abc58de2bdc5305419181c8b33eb1c or later
Vendor Advisory: https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc5305419181c8b33eb1c
Restart Required: Yes
Instructions:
1. Update localai to commit 31a4c9c9d3abc58de2bdc5305419181c8b33eb1c or later. 2. Pull the latest Docker image if using containers. 3. Restart the localai service to apply changes.
🔧 Temporary Workarounds
Disable TranscriptEndpoint
allTemporarily disable the vulnerable endpoint until patching is complete.
Modify localai configuration to disable the /transcribe endpoint or restrict access via firewall rules.
Input Validation Filter
allImplement a web application firewall or proxy that filters malicious filenames containing shell metacharacters.
Configure WAF rules to block requests with filenames containing characters like ;, &, |, $, (, ), `, or newlines.
🧯 If You Can't Patch
- Run localai with minimal privileges using a non-root user and container isolation.
- Implement strict network segmentation to limit access to the vulnerable endpoint only to trusted sources.
🔍 How to Verify
Check if Vulnerable:
Check if your localai version is prior to commit 31a4c9c9d3abc58de2bdc5305419181c8b33eb1c by examining the git commit hash or version tags.Check Version:
git log --oneline -1Verify Fix Applied:
Verify that the audioToWav function now uses proper argument passing to ffmpeg without shell command injection by reviewing the patched code.📡 Detection & Monitoring
Log Indicators:
- Unusual ffmpeg command executions with shell metacharacters in filenames
- Unexpected process spawns from the localai service
Network Indicators:
- HTTP requests to /transcribe endpoint with suspicious filenames containing shell characters
SIEM Query:
source="localai" AND (url="/transcribe" AND filename MATCHES "[;&|$()`\n]")