text-generation-webui RAG Extensions Vulnerable to SSRF and Credential Theft
Overview
The text-generation-webui, a popular open-source interface for Large Language Models, has a critical Server-Side Request Forgery (SSRF) vulnerability within its he superbooga and superboogav2 RAG (Retrieval-Augmented Generation) extensions. Versions prior to 4.3 fail to properly validate user-supplied URLs used in the RAG pipeline. Specifically, the `requests.get()` function is called without any checks for URL schemes, IP address filtering, or hostname allowlisting. This allows an attacker to craft malicious URLs that can be used to probe internal network services, access sensitive cloud metadata endpoints (such as those used for instance identity and credentials in cloud environments like AWS, Azure, or GCP), and potentially exfiltrate IAM credentials. The fetched content, which could include stolen credentials or sensitive information about internal infrastructure, is then processed and exfiltrated through the RAG pipeline, making it accessible to the attacker. This poses a significant risk of credential compromise and unauthorized access to internal resources.
Affected Systems
Testing Guide
1. Ensure you are running a version of text-generation-webui prior to 4.3. 2. Configure the he superbooga or superboogav2 RAG extension. 3. In a RAG context, submit a URL pointing to a known cloud metadata endpoint (e.g., `http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name` for AWS). 4. Observe if the application attempts to fetch content from this URL and if any information is returned or logged within the RAG pipeline output. 5. Alternatively, attempt to resolve internal-only hostnames (e.g., internal DNS names) via the RAG extension to check for internal network probing.
Mitigation Steps
- Update text-generation-webui and its RAG extensions to version 4.3 or later. - Implement network segmentation to restrict access from the web UI server to internal metadata services and sensitive endpoints. - Employ a Web Application Firewall (WAF) to filter out potentially malicious URL patterns. - Configure strict hostname allowlists for any external URL fetching functionalities if they are absolutely necessary, though disabling them is preferred. - Regularly review cloud provider security configurations, especially IAM roles and access policies, to minimize the impact of potential credential theft.
Patch Details
Fixed in text-generation-webui version 4.3