CVE-2024-9309

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

State: Published
Severity: 9.3 Critical
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Sep 27, 2024

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

Scores

CVSS	Score	Vector	Source
3.0	9.3 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	@huntr_ai

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
haotian-liu/llavahaotian-liu	latest and earlierAffected

References

https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.