haotian-liu llava Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability exists in haotian-liu/llava, specifically in version git c121f04. This vulnerability enables an attacker to manipulate the server into making HTTP requests to arbitrary URLs. Such exploitation could lead to unauthorized access to sensitive data available only from the server, including AWS metadata credentials.

Impact

Exploitation of this vulnerability could allow attackers to access sensitive server-side data, such as AWS metadata credentials, potentially leading to further exploitation of AWS resources.