CVE-2024-32025
📋 TL;DR
CVE-2024-32025 is a command injection vulnerability in Kohya_ss's group_images_gui.py that allows attackers to execute arbitrary commands on the system. This affects all users running vulnerable versions of Kohya_ss, particularly those exposing the GUI to untrusted networks. The vulnerability stems from improper neutralization of special elements used in an OS command.
💻 Affected Systems
- Kohya_ss
📦 What is this software?
Kohya Ss by Bmaltais
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing arbitrary command execution as the application user, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution leading to unauthorized access, data exfiltration, or installation of backdoors/malware on affected systems.
If Mitigated
Limited impact if system runs with minimal privileges, network segmentation is in place, and proper input validation is enforced.
🎯 Exploit Status
The vulnerability is well-documented in security advisories with technical details that make exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.1.5
Vendor Advisory: https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-qprv-9pg5-h33c
Restart Required: Yes
Instructions:
1. Stop all Kohya_ss processes. 2. Update to version 23.1.5 or later using: pip install --upgrade kohya_ss. 3. Restart the application.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to Kohya_ss GUI to trusted IPs only
# Use firewall rules to restrict access
sudo ufw allow from TRUSTED_IP to any port 7860
# Or use iptables: sudo iptables -A INPUT -p tcp --dport 7860 -s TRUSTED_IP -j ACCEPT
Run with Minimal Privileges
linuxRun Kohya_ss as a non-privileged user to limit potential damage
sudo useradd -r -s /bin/false kohya_user
sudo -u kohya_user python launch.py
🧯 If You Can't Patch
- Disable or remove the group_images_gui.py component if not required
- Implement strict network segmentation and firewall rules to isolate Kohya_ss from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Kohya_ss version: python -c "import kohya_ss; print(kohya_ss.__version__)" and compare to 23.1.5Check Version:
python -c "import kohya_ss; print(kohya_ss.__version__)"Verify Fix Applied:
Verify version is 23.1.5 or higher and check that commit 831af8babeb75faff62bcc6a8c6a4f80354f1ff1 is present in the installation📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Suspicious process creation from Kohya_ss
- Unexpected network connections originating from Kohya_ss process
Network Indicators:
- Unexpected outbound connections from Kohya_ss host
- Command and control traffic patterns
- Data exfiltration attempts
SIEM Query:
process.name:kohya_ss AND (process.cmdline:*cmd* OR process.cmdline:*sh* OR process.cmdline:*powershell*)🔗 References
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-qprv-9pg5-h33c
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-qprv-9pg5-h33c
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
