PT-2025-12097 · Unknown · Automatic1111/Stable-Diffusion-Webui

Published 2025-03-20 · Updated 2025-08-05 · CVE-2024-11045

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions automatic1111/stable-diffusion-webui version 1.10.0

Description A Cross-Site WebSocket Hijacking (CSWSH) vulnerability allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability is due to a lack of proper validation on WebSocket connections at the /queue/join API endpoint (ws://127.0.0.1:7860/queue/join), enabling unauthorized actions on the server. This can lead to unauthorized cloning of server extensions, execution of malicious scripts, data exfiltration, and potential denial of service (DoS).

Recommendations Ensure proper validation of WebSocket connections at ws://127.0.0.1:7860/queue/join to prevent unauthorized actions.

Exploit

Fix

DoS

Improper Access Control

Origin Validation Error

Weakness Enumeration

CWE-284

CWE-346

Related Identifiers

CVE-2024-11045

Affected Products

Automatic1111/Stable-Diffusion-Webui

References · 5

• 🔥 https://huntr.com/bounties/b7ed0d87-0be5-4526-9b21-ffe0d39c283e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11045 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11045 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671146803511761 · Twitter Post
• https://t.me/cveNotify/130944 · Telegram Post