Unauthenticated File Read in Xinference

Executive Summary

Xinference contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a model_path parameter without authentication or path restrictions. It reads and parses specific files (config.json, tokenizer_config.json, chat_template.jinja) at the supplied path and reflects their content back to the caller. This allows attackers to probe the server filesystem and extract files with those names from any directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the affected Xinference endpoint (POST /v1/models/llm/auto-register) is accessible without authentication. Use curl to send a test request with a model_path parameter pointing to a sensitive file, such as: curl -X POST http://<target>/v1/models/llm/auto-register -H 'Content-Type: application/json' -d '{"model_path": "/etc/passwd"}'.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker could exploit this to read sensitive files on the server, including configuration files, tokens, or other sensitive data. This could lead to information disclosure, potential privilege escalation, or further attacks if credentials or keys are exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Xinference to a patched version or apply a vendor-supplied fix. If an upgrade is not possible, restrict access to the /v1/models/llm/auto-register endpoint using network-level controls like firewalls or disable the endpoint entirely.

Useful 0 Not Useful 0