haotian-liu llava Server-Side Request Forgery Vulnerability in /run/predict Endpoint

A Server-Side Request Forgery (SSRF) vulnerability has been identified in haotian-liu/llava version 1.2.0 (LLaVA-1.6). The issue arises in the /run/predict endpoint, where insufficient validation of the path parameter allows attackers to send crafted requests that access internal networks or the AWS metadata endpoint. This vulnerability could lead to unauthorized network access, exposure of sensitive data, and further exploitation within the network.

Impact

Exploitation of this vulnerability could result in unauthorized access to internal networks or the AWS metadata endpoint, allowing attackers to expose sensitive data and potentially exploit other vulnerabilities within the network.