Vulnerability · Published Apr 1, 2024 · Assigned by @huntr_ai
CVE-2024-3135Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai
Medium 6.5
In plain English
A medium-severity cross-site request forgery in mudler/localai from mudler. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consent. This vulnerability enables attackers to exhaust system resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating images or uploading files. The vulnerability stems from the application's acceptance of simple request content-types without requiring CSRF tokens or implementing other CSRF mitigation measures. Successful exploitation does not require network access to the vulnerable LocalAI environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/go-skynet/LocalAI | no fix listed | GHSA-jhvf-7c85-3c9g |
| Go | github.com/go-skynet/LocalAI | no fix listed | GO-2024-2705 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mudler | mudler/localai | unspecified – through latest |
Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H