CVE-2024-6095

2024-07-0618:15:02

CWE-918

@huntr_ai

web.nvd.nist.gov

vulnerability

mudler/localai

ssrf

lfi

/models/apply

version 2.17

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

mudlerlocalaiRange<2.17.0

VendorProductVersionCPE
mudlerlocalai*cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mudler	localai	*	cpe:2.3:a:mudler:localai::::::::

CNA Affected

[
  {
    "vendor": "mudler",
    "product": "mudler/localai",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.17",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]