PT-2025-12274 · Llava · Llava

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9309

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions haotian-liu/llava version v1.2.0

Description A Server-Side Request Forgery (SSRF) issue exists in the "POST /worker generate stream" API endpoint of the Controller API Server. This allows attackers to exploit the server's credentials, performing unauthorized web actions or accessing unauthorized web resources.

Recommendations For version v1.2.0, consider disabling access to the "POST /worker generate stream" API endpoint until a patch is available. Restrict access to the vulnerable endpoint to minimize the risk of exploitation. Avoid using the worker generate stream function in the affected API endpoint until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-9309

Affected Products

Llava

References · 4

• 🔥 https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9309 · Security Note
• https://twitter.com/CVEnew/status/1902968878537511358 · Twitter Post