Listen to this Post
The vulnerability exists within the `_process_request` function of src/llamafactory/api/chat.py. This function processes user-supplied URLs for multimedia content (images, videos, audio). It first checks if the input is a base64 data URI or a local file path using os.path.isfile(). If both checks fail, the code defaults to treating the input as a web URI. It then uses `requests.get(url, stream=True).raw` to fetch the resource without any validation, sanitization, or restriction on the target URL. This lack of a whitelist or network segmentation allows an attacker to supply any URL, including those targeting internal, non-routable networks (SSRF) or local file paths (LFI). The vulnerable function is called by the public `/v1/chat/completions` API endpoint, making it accessible to any authenticated user who can send a crafted request with a malicious URL in the message payload.
Platform: LLaMA Factory
Version: Pre-1.7.0
Vulnerability: SSRF & LFI
Severity: Critical
date: 2024-10-08
Prediction: Patch by 2024-10-22
What Undercode Say:
curl -X POST "http://127.0.0.1:8000/v1/chat/completions" -H "Authorization: Bearer KEY" -d '{"messages":[{"role":"user","content":[{"type":"text","text":"test"},{"type":"image_url","image_url":{"url":"http://169.254.169.254/"}}]}]}'
Vulnerable code snippet if os.path.isfile(url): read local file else: image_stream = requests.get(url, stream=True).raw
How Exploit:
Craft malicious API request.
Target internal cloud metadata.
Read local server files.
Protection from this CVE
Update LLaMA Factory.
Implement URL allowlists.
Sanitize user inputs.
Use network security groups.
Impact:
Internal network reconnaissance.
Sensitive file disclosure.
Cloud credential theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
