Llamafactory
Monthly
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.