LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Internlm Lmdeploy
cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*
|
— |
<= 0.14.0
|
References 4
https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997…
disclosure@vulncheck.com
https://github.com/InternLM/lmdeploy/issues/4761
disclosure@vulncheck.com
https://github.com/InternLM/lmdeploy/pull/4734
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-h…
disclosure@vulncheck.com