CVE-2024-32027
📋 TL;DR
CVE-2024-32027 is a command injection vulnerability in Kohya_ss GUI for Stable Diffusion trainers. Attackers can execute arbitrary commands on affected systems by injecting malicious input into the finetune_gui.py component. Users running Kohya_ss v22.6.1 or earlier versions are affected.
💻 Affected Systems
- Kohya_ss
📦 What is this software?
Kohya Ss by Bmaltais
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing remote code execution, data theft, ransomware deployment, or complete system takeover.
Likely Case
Unauthorized command execution leading to data exfiltration, cryptocurrency mining, or lateral movement within the network.
If Mitigated
Limited impact with proper input validation and execution restrictions in place.
🎯 Exploit Status
Proof-of-concept available in GitHub advisory. Exploitation requires user interaction with the GUI but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.1.5
Vendor Advisory: https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-8h78-3vqm-xw83
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Kohya_ss to version 23.1.5 or later using pip: 'pip install --upgrade kohya_ss'. 3. Restart the application.
🔧 Temporary Workarounds
Input Validation Enhancement
allAdd input sanitization to user-controlled parameters in finetune_gui.py
# Manual code review and sanitization of user inputs in finetune_gui.py
Network Isolation
allRestrict network access to Kohya_ss instance
# Firewall rule: iptables -A INPUT -p tcp --dport [KOHYA_PORT] -j DROP
# Windows: netsh advfirewall firewall add rule name="Block Kohya" dir=in action=block protocol=TCP localport=[KOHYA_PORT]
🧯 If You Can't Patch
- Disable or remove Kohya_ss from production systems
- Implement strict network segmentation and monitor for suspicious command execution
🔍 How to Verify
Check if Vulnerable:
Check Kohya_ss version: 'python -c "import kohya_ss; print(kohya_ss.__version__)"' and compare to v22.6.1Check Version:
python -c "import kohya_ss; print(kohya_ss.__version__)"Verify Fix Applied:
Verify version is 23.1.5 or later: 'python -c "import kohya_ss; print(kohya_ss.__version__)"'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Suspicious process creation from Kohya_ss
- Unexpected network connections from Kohya_ss process
Network Indicators:
- Outbound connections to suspicious IPs from Kohya_ss
- Unexpected data exfiltration patterns
SIEM Query:
Process Creation where Parent Process contains 'python' AND Command Line contains 'kohya' AND (Command Line contains ';' OR '|' OR '&' OR '`')🔗 References
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-8h78-3vqm-xw83
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
- https://github.com/bmaltais/kohya_ss/commit/831af8babeb75faff62bcc6a8c6a4f80354f1ff1
- https://github.com/bmaltais/kohya_ss/security/advisories/GHSA-8h78-3vqm-xw83
- https://securitylab.github.com/advisories/GHSL-2024-019_GHSL-2024-024_kohya_ss
