Lucene search

@huntr_aiCVE-2024-6983

HistorySep 27, 2024 - 4:15 p.m.

CVE-2024-6983

2024-09-2716:15:06

CWE-94

@huntr_ai

web.nvd.nist.gov

mudler/localai

version 2.17.1

remote code execution

binary file

malicious code

full control

system

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

Percentile

9.6%

JSON

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system.

Affected configurations

Vulners

Vulnrichment

Node

mudlerlocalaiMatch2.19.4

VendorProductVersionCPE
mudlerlocalai2.19.4cpe:2.3:a:mudler:localai:2.19.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mudler	localai	2.19.4	cpe:2.3:a:mudler:localai:2.19.4:::::::*

CNA Affected

[
  {
    "vendor": "mudler",
    "product": "mudler/localai",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.19.4",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/mudler/localai/commit/d02a0f6f01d5c4a926a2d67190cb55d7aca23b66

huntr.com/bounties/f91fb287-412e-4c89-87df-9e4b6e609647

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-6983