CVE-2024-9309: Hliu Llava SSRF Vulnerability

CVE-2024-9309 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This critical vulnerability enables attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources, potentially leading to significant data breaches and lateral movement within internal networks.

Critical Impact

Attackers can leverage the server's trusted position to access internal services, bypass firewall restrictions, and potentially exfiltrate sensitive data from protected network segments.

Affected Products

• Hliu LLaVA version 1.2.0 (LLaVA-1.6)
• Controller API Server component
• POST /worker_generate_stream API endpoint

Discovery Timeline

• 2025-03-20 - CVE-2024-9309 published to NVD
• 2025-07-15 - Last updated in NVD database

Technical Details for CVE-2024-9309

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability resides within the Controller API Server component of the LLaVA multimodal AI framework. The vulnerability allows unauthenticated remote attackers to induce the server to make arbitrary HTTP requests to internal or external destinations.

The affected endpoint (/worker_generate_stream) processes user-supplied input without adequate validation of the target URL or resource. When the server processes requests through this endpoint, it uses its own credentials and network position to make outbound requests. This trusted position can be weaponized by attackers to bypass network security controls that would otherwise block external access to internal resources.

The scope of this vulnerability extends beyond the vulnerable component itself, as successful exploitation can impact other systems and services accessible from the Controller API Server's network position.

Root Cause

The root cause of this vulnerability is improper input validation in the /worker_generate_stream endpoint (CWE-918: Server-Side Request Forgery). The application fails to adequately validate, filter, or sanitize user-supplied URL parameters before using them to construct outbound HTTP requests. This allows attackers to manipulate the destination of server-initiated requests, effectively turning the Controller API Server into a proxy for malicious activities.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious requests to the vulnerable endpoint, specifying internal network addresses or cloud metadata endpoints as targets. The server will then initiate requests to these destinations using its own credentials and network privileges.

Typical attack scenarios include:

• Accessing cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254)
• Scanning internal network services and ports
• Accessing internal APIs and administrative interfaces
• Bypassing IP-based access controls
• Exfiltrating sensitive data from internal services

For detailed technical information about this vulnerability, refer to the Huntr Security Bounty report.

Detection Methods for CVE-2024-9309

Indicators of Compromise

• Unusual outbound HTTP requests from the Controller API Server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Requests to cloud metadata endpoints such as 169.254.169.254 or fd00:ec2::254
• High volume of requests to the /worker_generate_stream endpoint from external sources
• Server-initiated connections to unexpected internal services or ports
• Anomalous response sizes or patterns from the /worker_generate_stream endpoint

Detection Strategies

• Implement network monitoring to detect and alert on outbound requests from the LLaVA Controller API Server to internal network ranges
• Deploy web application firewall (WAF) rules to inspect and block requests containing internal IP addresses or cloud metadata URLs
• Enable comprehensive logging on the /worker_generate_stream endpoint to capture request parameters and destinations
• Configure intrusion detection systems (IDS) to identify SSRF attack patterns in API traffic

Monitoring Recommendations

• Monitor outbound connections from the Controller API Server for connections to private IP ranges and localhost
• Track API request patterns for anomalous behavior, particularly requests with URL-like parameters pointing to internal resources
• Set up alerts for failed authentication attempts to internal services originating from the LLaVA server
• Review server logs regularly for requests containing suspicious URL schemes or encoded IP addresses

How to Mitigate CVE-2024-9309

Immediate Actions Required

• Restrict network access to the Controller API Server, limiting exposure to trusted networks only
• Implement allowlist-based URL validation to restrict outbound requests to known, trusted destinations
• Deploy network segmentation to isolate the LLaVA server from sensitive internal resources
• Apply egress filtering rules to block outbound requests to internal IP ranges and metadata endpoints
• Review and audit recent logs for evidence of exploitation attempts

Patch Information

At the time of publication, no official vendor patch has been confirmed for this vulnerability. Organizations should monitor the Huntr Security Bounty page and the LLaVA GitHub repository for security updates. Until a patch is available, implement the workarounds and mitigations described below.

Workarounds

• Implement a strict allowlist of permitted destination URLs for the /worker_generate_stream endpoint
• Deploy a reverse proxy or WAF in front of the Controller API Server to filter malicious requests
• Use network-level controls to prevent the server from initiating connections to internal resources
• Disable or restrict access to the vulnerable endpoint if not required for operations
• Consider running the LLaVA service in an isolated network segment with no access to sensitive internal resources

# Example iptables rules to block SSRF to internal networks
# Apply to the server running LLaVA Controller API

# Block outbound to private IPv4 ranges
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner llava-user -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner llava-user -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner llava-user -j DROP

# Block access to cloud metadata services
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner llava-user -j DROP

# Block localhost connections (adjust as needed)
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner llava-user -j DROP