Server-Side Request Forgery in haotian-liu/llava

The SSRF vulnerability in LLaVA allows an attacker to manipulate the application into making requests to unintended destinations. By crafting specific requests to the /run/predict endpoint, an attacker can potentially access internal network services that are not directly exposed to the internet. A particularly concerning scenario involves accessing the AWS metadata endpoint (169.254.169.254), which could expose sensitive information such as AWS credentials and instance details. This could lead to complete compromise of the underlying infrastructure. The blast radius extends to any internal resources accessible from the LLaVA server.

Organizations deploying LLaVA in environments with access to sensitive internal resources, particularly those utilizing AWS infrastructure, are at significant risk. Shared hosting environments where LLaVA is deployed alongside other applications could also be vulnerable, as an attacker could potentially leverage the SSRF vulnerability to access resources belonging to other tenants.

• python / server:

import requests
import urllib.parse

def check_ssrf(url):
    try:
        parsed_url = urllib.parse.urlparse(url)
        if parsed_url.netloc == '169.254.169.254':
            print(f"Potential SSRF detected: {url}")
        else:
            print(f"URL is safe: {url}")
    except Exception as e:
        print(f"Error parsing URL: {e}")

# Example usage
check_ssrf('http://169.254.169.254/latest/meta-data/')

• generic web:

curl -I 'http://your-llava-server/run/predict?path=http://169.254.169.254/latest/meta-data/'

Examine the response headers and body for any signs of internal network access.

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-11-19
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-11449 is to implement robust input validation on the /run/predict endpoint. Specifically, the path parameter should be strictly validated to prevent attackers from injecting malicious URLs. Consider implementing a whitelist of allowed domains or using a URL sanitization library. Network segmentation can also limit the potential impact by restricting the LLaVA server's access to internal resources. While a direct patch is pending, restricting outbound network access to only necessary services is a crucial temporary measure. Monitor the haotian-liu/llava repository for updates and apply the fix as soon as it becomes available. After applying mitigations, verify by attempting to access the AWS metadata endpoint through the /run/predict endpoint and confirming access is denied.