Description
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
hiyouga LlamaFactory
Default version status: unaffected
0 to ≤ 0.9.5affected
pkg:pypi/llamafactoryReferences
- https://github.com/hiyouga/LlamaFactory/issues/10646 ↗
- https://github.com/hiyouga/LlamaFactory ↗
- https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/chat.py ↗
- https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/common.py ↗
- https://www.vulncheck.com/advisories/llama-factory-ssrf-guard-bypass-via-redirect-and-dns-rebinding ↗