CVE-2024-48057
📋 TL;DR
LocalAI versions up to 2.20.1 contain a stored cross-site scripting (XSS) vulnerability in the delete model API. When malicious parameters are passed to this API, they can be stored and later executed when users visit the homepage, potentially allowing attackers to steal session cookies or perform unauthorized actions. This affects all LocalAI deployments using vulnerable versions.
💻 Affected Systems
- LocalAI
📦 What is this software?
Localai by Mudler
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals admin session cookies, gains full control of LocalAI instance, and potentially compromises the underlying server.
Likely Case
Attacker steals user session cookies, performs unauthorized actions within LocalAI, or redirects users to malicious sites.
If Mitigated
XSS payloads are blocked by content security policies or modern browser protections, limiting impact to basic UI manipulation.
🎯 Exploit Status
Exploitation requires API access but payload execution occurs when legitimate users visit the homepage.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 2.20.1
Vendor Advisory: https://github.com/mudler/LocalAI
Restart Required: Yes
Instructions:
1. Update LocalAI to version >2.20.1
2. Restart the LocalAI service
3. Verify the fix by checking the version
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation and sanitization for all API parameters, especially the delete model endpoint.
# Requires code modification to sanitize inputs before processing
Content Security Policy
allImplement strict Content Security Policy headers to prevent XSS payload execution.
# Add to web server configuration:
# Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Restrict API access to trusted users only using authentication and IP whitelisting
- Implement web application firewall (WAF) rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check LocalAI version. If version <= 2.20.1, the system is vulnerable.Check Version:
localai --versionVerify Fix Applied:
After updating, test the delete model API with XSS payloads and verify they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual delete model API calls with JavaScript payloads in parameters
- Multiple failed delete attempts with suspicious parameters
Network Indicators:
- HTTP requests to delete model endpoint containing script tags or JavaScript code
SIEM Query:
source="localai.log" AND "DELETE /models/" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")