Description
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hiyouga | LlamaFactory | ≤ 0.9.5 | — |
References
- GitHub Issue #10646 issue-tracking
- https://github.com/hiyouga/LlamaFactory product
- https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/chat.py technical-description
- https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/common.py technical-description
- VulnCheck Advisory: LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding third-party-advisory