CVE-2024-9309
📋 TL;DR
This SSRF vulnerability in LLaVA's Controller API Server allows attackers to make the server send unauthorized requests to internal or external systems using its credentials. It affects anyone running haotian-liu/llava v1.2.0 with the Controller API Server exposed. Attackers could access sensitive internal resources or perform actions as the server.
💻 Affected Systems
- haotian-liu/llava
📦 What is this software?
Llava by Hliu
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal infrastructure via credential theft, data exfiltration, or lateral movement to cloud metadata services and internal APIs.
Likely Case
Unauthorized access to internal web services, cloud metadata endpoints, or sensitive APIs accessible from the server's network position.
If Mitigated
Limited to accessing only external resources if proper network segmentation and egress filtering are implemented.
🎯 Exploit Status
Exploitation requires network access to the vulnerable endpoint but no authentication. SSRF attacks are well-understood with many existing tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.2.1 or later
Vendor Advisory: https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12
Restart Required: Yes
Instructions:
1. Update to haotian-liu/llava v1.2.1 or later. 2. Restart the Controller API Server. 3. Verify the fix by testing the endpoint.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the Controller API Server to only required destinations.
Input Validation
allImplement strict URL validation and whitelist allowed domains in the POST /worker_generate_stream endpoint.
🧯 If You Can't Patch
- Implement strict network egress filtering to block all outbound traffic except to explicitly allowed destinations.
- Deploy a web application firewall (WAF) with SSRF protection rules in front of the Controller API Server.
🔍 How to Verify
Check if Vulnerable:
Check if running haotian-liu/llava v1.2.0 and test the POST /worker_generate_stream endpoint with SSRF payloads targeting internal services.Check Version:
Check the repository version or package manifest for 'v1.2.0'Verify Fix Applied:
After updating to v1.2.1+, test the same SSRF payloads should fail or be blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the Controller API Server to internal IPs or cloud metadata endpoints
- Multiple failed SSRF attempts in API logs
Network Indicators:
- Unexpected HTTP traffic from the Controller API Server to internal network segments
- Requests to cloud metadata services (169.254.169.254, etc.)
SIEM Query:
source="controller_api" AND (dest_ip=~"10.*|172.16.*|192.168.*|169.254.169.254")