CVE-2024-12068

Executive Summary

CVE-2024-12068 is a Server-Side Request Forgery (SSRF) vulnerability in the haotian-liu/llava project, specifically in commit c121f04. The flaw allows an unauthenticated attacker to force the server to make arbitrary HTTP requests to internal or external resources. This can be leveraged to access sensitive data only reachable from the server, such as AWS metadata credentials (e.g., http://169.254.169.254/latest/meta-data/). The vulnerability has a CVSS score of 7.5 (High) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the risk remains significant for deployments in cloud environments.

Supply Chain & Package Security

This vulnerability affects the open-source project haotian-liu/llava, which is a multimodal AI model (Large Language and Vision Assistant). The project is distributed via GitHub and can be integrated into applications as a dependency. There is no official package on PyPI or npm, but users may clone the repository directly. The lack of a patch and vendor response means that any system running this commit is at risk. Supply chain security is critical: organizations using this software should verify they are not running the vulnerable commit and consider forking or applying custom mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – Sensitive data (e.g., cloud metadata) can be exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High (7.5). The vulnerability is easy to exploit and can lead to severe data breaches, especially in cloud environments.

Deep Dive & Mechanics

The SSRF vulnerability exists in the llava server component, likely in an endpoint that accepts a URL parameter and fetches content from it without proper validation. The server does not restrict the target IP addresses or protocols, allowing an attacker to specify internal IPs (e.g., 169.254.169.254 for AWS metadata) or other internal services.

Root Cause: The application uses a function like requests.get(url) or urllib.request.urlopen(url) where the url is directly taken from user input without sanitization. No allowlist of permitted domains or IPs is enforced, and no blocklist for private IP ranges is applied.

Attack Flow:

1. Attacker sends a crafted HTTP request to the vulnerable endpoint with a url parameter pointing to an internal resource.
2. The server processes the request and makes an HTTP GET to the attacker-specified URL.
3. The response from the internal resource is returned to the attacker, leaking sensitive data.

Example vulnerable endpoint (hypothetical):

POST /process_image
Content-Type: application/json

{"image_url": "http://169.254.169.254/latest/meta-data/"}

Vulnerable vs. Patched Code

Vulnerable Code (commit c121f04):

# server.py (simplified)
import requests

def fetch_image(url):
    response = requests.get(url)
    return response.content

@app.route('/process_image', methods=['POST'])
def process_image():
    data = request.get_json()
    image_url = data['image_url']
    image_data = fetch_image(image_url)
    # process image...

Patched Code (hypothetical fix):

# server.py (patched)
import requests
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['example.com', 'images.example.com']
BLOCKED_IPS = ['169.254.169.254', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']

def is_safe_url(url):
    parsed = urlparse(url)
    hostname = parsed.hostname
    # Check domain allowlist
    if hostname not in ALLOWED_DOMAINS:
        return False
    # Resolve IP and check blocklist (simplified)
    import socket
    ip = socket.gethostbyname(hostname)
    if ip in BLOCKED_IPS:
        return False
    return True

def fetch_image(url):
    if not is_safe_url(url):
        raise ValueError("URL not allowed")
    response = requests.get(url, timeout=5)
    return response.content

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable instance of llava (commit c121f04) in a Docker container.
2. Set up a simple HTTP server to simulate internal services (e.g., AWS metadata endpoint).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /process_image).
2. Send a POST request with a malicious URL:

curl -X POST http://target:5000/process_image \
  -H "Content-Type: application/json" \
  -d '{"image_url": "http://169.254.169.254/latest/meta-data/"}'

3. The server will fetch the AWS metadata and return it in the response.

Advanced Exploitation:

• Use SSRF to scan internal networks (e.g., http://10.0.0.1:8080).
• Leverage cloud metadata endpoints for credential theft (AWS, GCP, Azure).
• Use file:// protocol if supported to read local files.

Blue Team (Defender)

Detection:

• Monitor outbound HTTP requests from the server to unexpected IPs (especially private ranges).
• Look for requests to 169.254.169.254 or other cloud metadata IPs.
• Analyze server logs for unusual URL parameters containing internal IPs.

Mitigation:

• Apply network segmentation to restrict server outbound access.
• Use a Web Application Firewall (WAF) to block requests with suspicious URL patterns.
• Implement input validation and allowlisting for URL parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Outbound HTTP requests to metadata.google.internal (GCP metadata)
  • Outbound HTTP requests to 169.254.169.254 (Azure metadata)
  • Requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• File IOCs:
  • Log entries containing image_url parameter with internal IPs
• Behavioral IOCs:
  • Unusual increase in outbound HTTP traffic from the server
  • Server making requests to ports not typically used (e.g., 8080, 3306)

Detection Engineering

YARA Rule

rule CVE_2024_12068_SSRF_LLAVA {
    meta:
        description = "Detects SSRF exploitation attempts against haotian-liu/llava"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-12068"
    strings:
        $url_param = "image_url" nocase
        $internal_ip = /169\.254\.169\.254|metadata\.google\.internal|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}/
        $http_get = "GET /" nocase
    condition:
        $url_param and $internal_ip and $http_get
}

Sigma Rule

title: SSRF Exploitation Against haotian-liu/llava (CVE-2024-12068)
id: 8a3f2c1e-5d7b-4a9f-8c2e-1b3d4f5a6c7d
status: experimental
description: Detects HTTP requests with internal IPs in the image_url parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "image_url"
        cs-uri-query|contains|expand:
            - "169.254.169.254"
            - "metadata.google.internal"
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate use of internal services (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12068 SSRF Attempt - haotian-liu/llava";
    flow:to_server,established;
    content:"image_url"; http_client_body;
    pcre:"/(169\.254\.169\.254|metadata\.google\.internal|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable server from sensitive internal networks.
2. Apply network-level controls to block outbound traffic to private IP ranges and cloud metadata endpoints.
3. Implement a reverse proxy with URL validation to filter malicious requests.

Long-term Fix:

• Patch the code by adding input validation and an allowlist of permitted domains.
• Upgrade to a patched version if the vendor releases one (currently none).
• Fork the repository and apply the fix yourself.

Workarounds:

• Disable the vulnerable endpoint if not needed.
• Use a Web Application Firewall (WAF) with rules to block SSRF patterns.
• Restrict server outbound access using firewall rules (e.g., allow only specific external IPs).

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.