CVE-2024-32022
📋 TL;DR
CVE-2024-32022 is a command injection vulnerability in Kohya_ss, a GUI for Stable Diffusion trainers. Attackers can execute arbitrary commands on affected systems by exploiting improper input validation in basic_caption_gui.py. This affects all users running vulnerable versions of Kohya_ss.
💻 Affected Systems
- Kohya_ss
📦 What is this software?
Kohya Ss by Bmaltais
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with the privileges of the Kohya_ss process, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution allowing attackers to install malware, exfiltrate data, or pivot to other systems on the network.
If Mitigated
Limited impact if system runs with minimal privileges, network segmentation is in place, and proper input validation prevents exploitation.
🎯 Exploit Status
The vulnerability is in a GUI component and exploitation details are publicly available in the advisory, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.1.5
Vendor Advisory: https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3
Restart Required: Yes
Instructions:
1. Stop the Kohya_ss application. 2. Update to version 23.1.5 or later using: pip install --upgrade kohya_ss. 3. Restart the application.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to Kohya_ss to trusted IP addresses only
# Example firewall rule for Linux: sudo iptables -A INPUT -p tcp --dport [KOHYA_PORT] -s [TRUSTED_IP] -j ACCEPT
# Example firewall rule for Windows: New-NetFirewallRule -DisplayName "Kohya_ss Access" -Direction Inbound -Protocol TCP -LocalPort [KOHYA_PORT] -RemoteAddress [TRUSTED_IP] -Action Allow
Run with Limited Privileges
allRun Kohya_ss with a non-privileged user account to limit potential damage
# Linux: sudo -u [non_privileged_user] python [kohya_ss_script]
# Windows: Run as a standard user account without administrative privileges
🧯 If You Can't Patch
- Disable or remove Kohya_ss until patching is possible
- Implement strict network segmentation and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check the Kohya_ss version: python -c "import kohya_ss; print(kohya_ss.__version__)" and compare to 23.1.5Check Version:
python -c "import kohya_ss; print(kohya_ss.__version__)"Verify Fix Applied:
Confirm version is 23.1.5 or later using the version check command and verify the basic_caption_gui.py file contains the security fixes from commit 831af8babeb75faff62bcc6a8c6a4f80354f1ff1📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Suspicious processes spawned by the Kohya_ss Python process
- Unexpected network connections from the Kohya_ss host
Network Indicators:
- Unusual outbound connections from Kohya_ss host
- Traffic to known malicious IPs or domains
SIEM Query:
process_name:"python" AND parent_process_name:"kohya_ss" AND (command_line:"*cmd*" OR command_line:"*powershell*" OR command_line:"*bash*")🔗 References
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-m6jq-7j4v-2fg3
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
