在 lm-sys/fastchat 的 POST /worker_generate_stream API 接口中的 SSRF 漏洞

攻击者可以利用此 SSRF 漏洞，通过 Controller API 服务器访问内部网络资源，例如数据库、管理界面或其他敏感服务。攻击者还可以利用此漏洞扫描内部网络，发现潜在的攻击面。更严重的情况下，攻击者可能能够利用服务器的身份验证凭据，访问外部网络资源，甚至执行恶意代码。由于漏洞影响 Controller API Server，攻击者可能能够控制整个 fastchat 系统，造成严重的安全风险。该漏洞的潜在影响类似于利用内部服务进行横向移动，进一步扩大攻击范围。

Organizations deploying lm-sys/fastchat for large language model serving, particularly those with exposed Controller API Servers, are at significant risk. This includes research labs, AI development teams, and any environment where fastchat is used to manage and orchestrate language models. Shared hosting environments where multiple users share the same fastchat instance are also particularly vulnerable.

• python / server: Monitor outbound network traffic from the fastchat Controller API Server for unexpected destinations. Use tools like tcpdump or Wireshark to capture and analyze traffic.

tcpdump -i any -n port 80 or port 443 | grep -i 'example.com'

• python / server: Examine fastchat logs for unusual requests to the /workergeneratestream and /register_worker endpoints. Look for requests with malformed URLs or unexpected parameters.

# Example log analysis (replace with your actual log parsing) 
import re
with open('fastchat.log', 'r') as f:
    for line in f:
        if re.search(r'/worker_generate_stream.*(http://|https://)', line):
            print(line)

• generic web: Check for unusual outbound connections from the fastchat server using ss or netstat.

1. 2024-12-30Disclosure

   disclosure

2. 2024-12-30Patch

   patch

1. 已保留2024-10-16
2. 发布日期2024-12-30
3. EPSS 更新日期2026-04-02

目前，官方尚未发布修复补丁。作为临时缓解措施，建议禁用或限制 Controller API Server 的 /workergeneratestream 接口的访问权限。可以通过配置防火墙规则，仅允许来自受信任来源的请求访问该接口。此外，建议审查并加强 Controller API Server 的身份验证机制，确保服务器使用的凭据安全可靠。如果必须使用该接口，请确保对所有请求进行严格的输入验证和过滤，以防止攻击者注入恶意 URL。在升级到修复版本后，请验证接口是否已正确修复，并确认系统功能是否正常。