CVE-2024-5616
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in mudler/LocalAI allows attackers to trick authenticated users into deleting installed AI models without their consent. This affects LocalAI versions up to and including 2.15.0. Attackers can exploit this by luring victims to malicious web pages that trigger unauthorized model deletion requests.
💻 Affected Systems
- mudler/LocalAI
📦 What is this software?
Localai by Mudler
⚠️ Risk & Real-World Impact
Worst Case
Critical AI models like 'gpt-4-vision-preview' are deleted, disrupting AI services and requiring time-consuming re-downloads and reconfiguration.
Likely Case
Attackers delete commonly used models, causing service disruption until models are restored from backups or re-downloaded.
If Mitigated
With proper CSRF protections, no unauthorized model deletions occur, maintaining service availability.
🎯 Exploit Status
Exploitation requires victim authentication and visiting malicious page. Proof-of-concept available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.15.0
Vendor Advisory: https://github.com/mudler/localai/commit/4e1463fec291612a59a16db60b3fd12d4c49d64b
Restart Required: Yes
Instructions:
1. Update LocalAI to version after 2.15.0. 2. Restart the LocalAI service. 3. Verify CSRF tokens are now required for model deletion requests.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to LocalAI web interface to trusted networks only
Configure firewall rules to limit access to LocalAI port (default 8080)
Reverse Proxy with CSRF Protection
linuxPlace LocalAI behind a reverse proxy that adds CSRF protection
Configure nginx/apache with CSRF token validation
🧯 If You Can't Patch
- Implement strict SameSite cookie policies for authentication
- Use browser extensions that block CSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check LocalAI version: if ≤2.15.0 and web interface accessible, likely vulnerableCheck Version:
Check LocalAI logs or API endpoint for version informationVerify Fix Applied:
Test model deletion endpoint requires CSRF token after update📡 Detection & Monitoring
Log Indicators:
- Unexpected model deletion events
- DELETE requests to /models/ endpoint without CSRF tokens
Network Indicators:
- Multiple DELETE requests from unexpected sources
- Requests with missing CSRF headers
SIEM Query:
source="localai" AND (event="model_deleted" OR method="DELETE") AND NOT csrf_token=*