-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| llamafactory | pip | <= 0.9.3 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 95b7188090a1018935c9dc072bfc97f24f1c96e9 confirms that the root cause of the vulnerability is in the _process_request function located in src/llamafactory/api/chat.py. This function is responsible for handling multimodal inputs, including URLs for images, videos, and audio.
The vulnerability arises because the function fails to sanitize or validate the URLs provided by the user before using them in sensitive operations. Specifically:
LFI: When a provided URL is identified as a local file path via os.path.isfile, the function proceeds to open it. This allows an attacker to submit a path to any readable file on the server (e.g., /etc/passwd), which will then be opened and processed.
SSRF: If the URL is not a local file or a data URI, the function assumes it is a web URI and makes a direct HTTP GET request to it using the requests library. This allows an attacker to force the server to make requests to internal network resources or cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/), exposing sensitive information.
The patch addresses these issues by introducing two new validation functions, check_lfi_path and check_ssrf_url, which are called immediately before the file opening and HTTP request operations, respectively. These functions are designed to restrict file access to a safe directory and to prevent requests to private or reserved IP addresses.
During exploitation, a profiler would show the _process_request function in the stack trace, as it is the function that directly handles the malicious input. The vulnerability description also indicates that this function is called by create_chat_completion_response and create_stream_chat_completion_response, which are the handlers for the public /v1/chat/completions API endpoint. Therefore, _process_request is the primary vulnerable function where the security flaw exists.
A Semantic Attack on Google Gemini - Read the Latest Research