CVE-2024-12068: Hliu Llava SSRF Vulnerability

CVE-2024-12068 Overview

CVE-2024-12068 is a Server-Side Request Forgery (SSRF) vulnerability in haotian-liu/llava, affecting the git c121f04 build. The flaw allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary URLs. Attackers can reach internal network services and cloud metadata endpoints from the vulnerable host. Successful exploitation can expose AWS instance metadata credentials and other resources reachable only from the server itself. The vulnerability is categorized under CWE-918 and requires no authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can force the LLaVA server to fetch attacker-controlled URLs, enabling access to internal services and cloud metadata credentials such as AWS IAM role tokens.

Affected Products

haotian-liu/llava at commit c121f04
LLaVA build dated 2024-05-11
Deployments exposing the LLaVA image/URL ingestion endpoint

Discovery Timeline

2025-03-20 - CVE-2024-12068 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12068

Vulnerability Analysis

LLaVA (Large Language and Vision Assistant) is an open-source multimodal model that accepts image inputs, including images referenced by URL. The affected code path fetches user-supplied URLs server-side without validating the destination host, scheme, or resolved IP address. An attacker submits a crafted URL, and the server issues an outbound HTTP request on the attacker's behalf.

Because the request originates from the server, it can reach endpoints that are otherwise isolated from the public internet. On cloud-hosted deployments, this includes the instance metadata service (IMDS) at 169.254.169.254, internal APIs, and lateral services on private subnets. Retrieving the IMDS response can expose IAM credentials tied to the instance role.

Root Cause

The root cause is missing validation of user-controlled URLs before the server-side fetch. The application does not enforce an allowlist of destinations, does not block link-local or private address ranges (127.0.0.0/8, 10.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16), and does not restrict permitted URL schemes. DNS rebinding and redirect chains are also not mitigated.

Attack Vector

Exploitation requires only network access to the LLaVA endpoint that accepts image URL parameters. The attacker submits a request containing a URL pointing to an internal target, for example the AWS metadata service path http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server fetches the URL and, depending on response handling, returns the content, an error message, or side-channel timing that leaks the response. Refer to the Huntr Security Bounty report for reproduction details.

Detection Methods for CVE-2024-12068

Indicators of Compromise

Outbound HTTP requests from the LLaVA host to 169.254.169.254, metadata.google.internal, or Azure IMDS (169.254.169.254/metadata/instance).
LLaVA process making connections to RFC1918 addresses that are not part of normal application flow.
Application logs showing image URL parameters containing internal, link-local, or loopback hostnames.
Unexpected use of IAM role credentials tied to the LLaVA instance from external IPs.

Detection Strategies

Inspect LLaVA request logs for URL parameters resolving to private, loopback, or link-local addresses.
Alert on any egress from AI/ML inference hosts to cloud metadata endpoints.
Correlate LLaVA process network activity with STS AssumeRole or GetCallerIdentity events in CloudTrail.

Monitoring Recommendations

Enable VPC Flow Logs and alert on connections from inference workloads to 169.254.169.254.
Log full URL parameters at the reverse proxy in front of LLaVA for retrospective analysis.
Monitor DNS queries from the LLaVA host for suspicious domains and short TTL records indicative of DNS rebinding.

How to Mitigate CVE-2024-12068

Immediate Actions Required

Restrict network access to the LLaVA service to trusted clients only, using firewall or reverse proxy rules.
Enforce IMDSv2 with hop limit 1 on AWS EC2 instances hosting LLaVA to block SSRF-based credential theft.
Remove or scope down IAM permissions attached to the LLaVA instance role to the minimum required.
Block egress from the LLaVA host to 169.254.169.254 and other metadata endpoints if not required.

Patch Information

No vendor patch or fixed release is referenced in the advisory at the time of publication. The vulnerability is documented in the Huntr Security Bounty report. Track the upstream haotian-liu/llava repository for security updates and apply URL validation in any downstream fork.

Workarounds

Implement a URL allowlist restricting fetches to known external image hosts.
Resolve submitted hostnames and reject requests that resolve to private, loopback, link-local, or reserved ranges.
Disable URL-based image ingestion where feasible and require direct file uploads instead.
Route outbound fetches through an egress proxy that enforces destination filtering and blocks metadata endpoints.

bash

# Example AWS CLI: enforce IMDSv2 to mitigate SSRF-based credential theft
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Example iptables rule: block LLaVA host egress to IMDS
iptables -A OUTPUT -d 169.254.169.254 -j DROP