LocalAI Unauthenticated SSRF via Gallery URL Parameter

Executive Summary

This vulnerability is an unauthenticated server-side request forgery (SSRF) in LocalAI's POST /models/apply endpoint. It occurs because the endpoint accepts gallery URL fields without proper validation and passes them directly to a function that fetches gallery configurations. As a result, attackers can make the server send HTTP GET requests to internal or private URLs, including loopback addresses, potentially accessing internal resources.

Additionally, partial response content is leaked through error messages, which can provide attackers with information about the internal network.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to access internal network resources that are normally inaccessible from outside the server. By exploiting the SSRF, attackers might gather sensitive information about internal systems or services.

The leakage of partial response content through error messages can further aid attackers in mapping the internal network or discovering sensitive data.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in LocalAI allows unauthenticated attackers to perform server-side request forgery (SSRF) via the POST /models/apply endpoint, enabling them to fetch arbitrary internal URLs and potentially access restricted internal resources. This can lead to unauthorized access to sensitive information within internal networks.

Such unauthorized access and potential data leakage could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data, as well as protection against unauthorized disclosure.

Because the vulnerability allows internal resource probing and partial response content leakage through error messages, it increases the risk of exposure of sensitive data, which could result in violations of data protection and privacy regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or unusual HTTP POST requests to the /models/apply endpoint on the LocalAI server, especially those containing crafted JSON bodies with manipulated gallery URL fields.

To detect exploitation attempts, you can look for POST requests to /models/apply with JSON payloads where the "id" field is empty and the "url" field points to internal or loopback IP addresses.

Example commands to detect such activity might include using network traffic inspection tools or web server logs filtering, such as:

• Using tcpdump or tshark to capture POST requests to /models/apply endpoint:
• tcpdump -i any -A 'tcp port 80 or tcp port 443' | grep 'POST /models/apply'
• Using grep on web server access logs to find suspicious POST requests:
• grep 'POST /models/apply' /var/log/nginx/access.log | grep -E '"id":""|"url":"http://127.0.0.1|"url":"http://192.168.'

Additionally, inspecting application logs for error messages leaking partial response content from internal URLs can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the official patch that fixes the vulnerability, which was introduced in commit f9b968e in the LocalAI repository.

If patching is not immediately possible, restrict access to the vulnerable POST /models/apply endpoint by implementing network-level controls such as firewall rules or API gateway restrictions to block unauthenticated external access.

Additionally, monitor and block requests with suspicious payloads that attempt to exploit the SSRF vulnerability by sending URLs pointing to internal or loopback addresses.

Review and apply URL validation logic similar to the protections used elsewhere in the codebase to ensure that only public IP addresses or allowed URLs are accepted by the endpoint.

Useful 0 Not Useful 0