vLLM SSRF Vulnerability via download_bytes_from_url
Overview
A critical Server-Side Request Forgery (SSRF) vulnerability exists in the vLLM inference engine, specifically within the `download_bytes_from_url` function. Affecting versions from 0.16.0 up to, but not including, 0.19.0, this flaw allows unauthenticated actors to manipulate the batch input JSON. By controlling this input, an attacker can coerce the vLLM batch runner into initiating arbitrary HTTP/HTTPS requests originating from the vLLM server itself. The vulnerability stems from a lack of robust URL validation and domain restrictions within the `download_bytes_from_url` function. This absence of checks permits the execution of requests to internal network resources, including sensitive cloud provider metadata endpoints (like EC2 instance metadata or Google Cloud metadata services) or other internal HTTP APIs, potentially leading to information disclosure, unauthorized access, or further compromise of the underlying infrastructure. The exploit requires the attacker to have the ability to control the data submitted in the batch input to the vLLM service.
Affected Systems
Testing Guide
1. Ensure you have a vLLM instance running with a version between 0.16.0 and 0.18.0. 2. Craft a batch input JSON payload that includes a URL pointing to a known internal service or a cloud metadata endpoint (e.g., `http://169.254.169.254/latest/meta-data/` for AWS). 3. Submit this crafted payload to the vLLM API. 4. Monitor the network traffic originating from the vLLM server or check the logs of the targeted internal service to verify if the request was made.
Mitigation Steps
- Upgrade vLLM to version 0.19.0 or later. - Implement strict network segmentation to limit the vLLM server's access to internal resources. - Deploy a Web Application Firewall (WAF) or API gateway with rules to detect and block suspicious URL patterns in batch inputs. - Sanitize and validate all user-controlled input, particularly URLs, before processing by the vLLM batch runner. - Employ egress filtering on the vLLM server to restrict outbound connections to only authorized destinations.
Patch Details
vLLM 0.19.0