CVE-2024-9308
📋 TL;DR
An open redirect vulnerability in haotian-liu/llava v1.2.0 allows attackers to redirect users to malicious websites via crafted URLs. This affects all users of LLaVA-1.6 who access the vulnerable interface. The vulnerability enables phishing, malware distribution, and credential theft attacks.
💻 Affected Systems
- haotian-liu/llava
📦 What is this software?
Llava by Hliu
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to sophisticated phishing sites that steal credentials or install malware, leading to account compromise, data breaches, or ransomware infections.
Likely Case
Attackers create convincing phishing links that redirect users to fake login pages, harvesting credentials for the LLaVA service or other accounts.
If Mitigated
With proper URL validation and user awareness, impact is limited to failed redirect attempts or warnings to users.
🎯 Exploit Status
Exploitation requires crafting a URL with malicious redirect parameters; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub repository for updates after v1.2.0
Vendor Advisory: https://huntr.com/bounties/6233a165-a435-464d-915c-4c7510ffbf82
Restart Required: Yes
Instructions:
1. Check the haotian-liu/llava GitHub repository for security updates. 2. Update to the latest patched version. 3. Restart the LLaVA service to apply changes.
🔧 Temporary Workarounds
Implement URL validation
allAdd server-side validation to reject or sanitize redirect URLs that point to external domains.
# Modify application code to validate redirect URLs; specific commands depend on implementation
Use allowlist for redirects
allRestrict redirects to a predefined list of trusted domains only.
# Configure application to allow redirects only to approved domains
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) with rules to block open redirect attempts.
- Educate users to verify URLs before clicking and use browser extensions that warn about suspicious redirects.
🔍 How to Verify
Check if Vulnerable:
Test by attempting to redirect to an external domain via a crafted URL parameter in the LLaVA interface.Check Version:
# Check LLaVA version in deployment; command varies by setup, e.g., check package version or git tagVerify Fix Applied:
After patching, retest the redirect attempt; it should fail or be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect requests in application logs, especially to external domains
Network Indicators:
- HTTP 302 redirects to suspicious domains in network traffic
SIEM Query:
Example: search for HTTP status 302 with external domain in referrer or URL parameters