CVE-2024-11449: Hliu LLaVA SSRF Vulnerability

CVE-2024-11449 Overview

CVE-2024-11449 is a Server-Side Request Forgery (SSRF) vulnerability in haotian-liu/llava version 1.2.0, also known as LLaVA-1.6. The flaw exists in the /run/predict endpoint, which fails to validate the path parameter before issuing outbound requests. Attackers can abuse this behavior to reach internal network resources or query the AWS instance metadata endpoint. Successful exploitation exposes sensitive data, including cloud credentials, and enables lateral movement inside the network perimeter. The vulnerability is tracked under CWE-918 and requires no authentication or user interaction.

Critical Impact
Unauthenticated attackers can pivot from the LLaVA inference server to internal services and cloud metadata endpoints, harvesting IAM credentials and sensitive infrastructure data.

Affected Products

haotian-liu/llava version 1.2.0 (LLaVA-1.6)
Deployments exposing the Gradio /run/predict endpoint
Cloud-hosted LLaVA instances with access to instance metadata services

Discovery Timeline

2025-03-20 - CVE-2024-11449 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11449

Vulnerability Analysis

The vulnerability resides in the LLaVA inference server's /run/predict endpoint, which accepts a path parameter used to fetch remote content. The application performs insufficient validation on this parameter, allowing an attacker to substitute arbitrary URLs. When the server processes the request, it initiates an outbound HTTP call to the attacker-controlled destination from its own network context. This grants attackers the network privileges of the LLaVA host, bypassing perimeter firewalls that normally block external traffic to internal services.

Root Cause

The root cause is missing URL scheme, host, and IP validation on the path parameter before it is passed to the HTTP client. The endpoint does not enforce an allowlist of trusted origins, block access to RFC 1918 private ranges, or reject link-local addresses such as 169.254.169.254. This category of flaw maps to CWE-918: Server-Side Request Forgery.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to /run/predict containing a path value that points to an internal resource. Common targets include the AWS metadata service at http://169.254.169.254/latest/meta-data/iam/security-credentials/, internal admin panels, and services bound to loopback. The LLaVA server executes the request and returns the response content to the attacker, leaking IAM role credentials, session tokens, or internal application data. See the Huntr bug bounty report for the disclosure details.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the vendor disclosure.

Detection Methods for CVE-2024-11449

Indicators of Compromise

Outbound HTTP requests from the LLaVA host to 169.254.169.254, 127.0.0.1, or RFC 1918 addresses that do not correspond to legitimate application traffic.
Requests to /run/predict containing path parameter values that include IP literals, file://, gopher://, or non-standard URL schemes.
Unexpected access patterns to internal admin endpoints originating from the inference server's IP address.

Detection Strategies

Inspect reverse proxy and application logs for /run/predict requests where the path parameter references internal hosts or metadata IPs.
Correlate outbound network flows from the LLaVA process against an allowlist of expected model download and telemetry endpoints.
Deploy egress filtering telemetry to flag any connection from the inference host to cloud metadata services.

Monitoring Recommendations

Enforce IMDSv2 on AWS instances and alert on IMDSv1 token-less requests originating from application workloads.
Route egress from LLaVA workloads through a forward proxy that logs the full destination URL for later analysis.
Baseline normal outbound traffic from AI inference hosts and alert on deviations, particularly connections to link-local or private ranges.

How to Mitigate CVE-2024-11449

Immediate Actions Required

Restrict network access to the /run/predict endpoint using authentication, IP allowlisting, or a VPN-only exposure model.
Enforce IMDSv2 on all cloud instances hosting LLaVA to require session tokens for metadata access.
Apply egress firewall rules that block outbound traffic from the LLaVA host to 169.254.169.254, loopback, and RFC 1918 ranges unless explicitly required.
Rotate any IAM credentials, API keys, or secrets that may have been exposed on affected instances.

Patch Information

No vendor patch is referenced in the NVD entry or the Huntr disclosure at the time of publication. Operators running haotian-liu/llava 1.2.0 should monitor the upstream repository for updates and apply compensating controls until a fix is released.

Workarounds

Place LLaVA behind an authenticating reverse proxy that validates and sanitizes the path parameter before forwarding requests.
Deploy a network policy that blocks the inference container from reaching metadata endpoints and internal management networks.
Run the service under a dedicated service account with minimal IAM permissions to limit the blast radius of credential theft.
Disable or remove the /run/predict endpoint if it is not required for production workloads.

bash

# Block AWS metadata access from LLaVA host (iptables example)
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Enforce IMDSv2 on an existing EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled