LMDeploy SSRF Vulnerability in Vision-Language Module
Overview
LMDeploy versions prior to 0.12.3 suffer from a Server-Side Request Forgery (SSRF) vulnerability within its vision-language module. The core of the issue lies in the `load_image()` function located in the `lmdeploy/vl/utils.py` file. This function is designed to fetch images from specified URLs, but it fails to perform adequate validation on the provided URLs. Specifically, it does not prevent requests to internal IP addresses or private network addresses. An attacker can exploit this by crafting a malicious URL that points to sensitive internal resources, such as cloud provider metadata services (e.g., EC2 instance metadata) or other internal network endpoints. Successful exploitation could lead to the leakage of confidential information, unauthorized access to internal systems, or the execution of further attacks by pivoting within the compromised network. The vulnerability is patched in version 0.12.3.
Affected Systems
Testing Guide
1. Ensure you have a non-vulnerable version of LMDeploy installed (e.g., < 0.12.3). 2. Set up a controlled environment where you can monitor network traffic and responses. 3. Craft a request to the LMDeploy API that includes a malicious URL pointing to a known internal resource or metadata endpoint (e.g., `http://169.254.169.254/latest/meta-data/`). 4. Observe the network traffic originating from the LMDeploy server. If the server attempts to connect to the malicious URL and the response from the internal resource is received by the attacker (or logged), the vulnerability is likely present. 5. Verify that a patched version (0.12.3+) does not exhibit this behavior.
Mitigation Steps
- Update LMDeploy to version 0.12.3 or later. - Implement network segmentation to restrict access to internal resources from the LMDeploy service. - Use a web application firewall (WAF) to filter out suspicious URLs and prevent access to sensitive internal endpoints. - Sanitize all user-supplied URLs before passing them to the `load_image()` function, ensuring they do not resolve to internal or private IP addresses. - Limit the network egress capabilities of the server running LMDeploy.
Patch Details
0.12.3