SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

The SSRF vulnerability in LLaVA's Controller API Server presents a significant risk. An attacker can exploit this to bypass security controls and access internal resources that should be protected. This could involve reading sensitive data from internal services, interacting with other systems on the network using the server's identity, or even potentially executing commands on other systems if the server has sufficient privileges. The ability to use the server's credentials for unauthorized web actions significantly expands the potential attack surface and increases the blast radius of a successful exploitation.

Organizations deploying LLaVA for image generation or multimodal AI applications are at risk. Specifically, those running the Controller API Server in environments with limited network segmentation or with overly permissive outbound access policies are particularly vulnerable. Shared hosting environments where the server's outbound access is not tightly controlled also face increased risk.

• python / server:

import requests
import urllib3

http = urllib3.PoolManager()

# Example: Check for outbound requests to unusual domains
response = http.request('GET', 'https://example.com/worker_generate_stream', headers={'User-Agent': 'LLaVA Controller API Server'}) # Replace with actual endpoint

if response.status >= 400:
    print(f"Potential SSRF attempt detected: {response.status}")

• generic web:

curl -I https://your-llava-server.com/worker_generate_stream # Check response headers for unusual redirects or server information

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-09-27
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

Due to the lack of a specific fixed version, immediate mitigation focuses on limiting the impact of the vulnerability. Implement strict network segmentation to isolate the Controller API Server from sensitive internal resources. Configure a Web Application Firewall (WAF) to block requests to the /workergeneratestream endpoint or filter requests based on allowed domains. Carefully review and restrict the server's outbound network access to only necessary services. Monitor logs for unusual outbound requests originating from the Controller API Server. After implementing these controls, verify their effectiveness by attempting to trigger the SSRF vulnerability in a controlled environment.