CVE-2024-9309 - SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

Back Back to CVE browser

CRITICAL

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

Published Mar 20, 2025

9.3

CRITICAL

CVSS 3.0

EPSS 0.50%

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

Affected products

Vendor Haotian-Liu Product Haotian-Liu/llava Default
unknown
Affected
- ≥ unspecified, ≤ latest

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Haotian-Liu	Haotian-Liu/llava	unknown	Affected ≥ unspecified, ≤ latest

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6871
Advisory
https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6871		Advisory
https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner @huntr_ai

Published Mar 20, 2025

Updated Mar 20, 2025

Reserved Sep 27, 2024

Link CVE-2024-9309

CISA Vulnrichment

Updated Mar 20, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-9309

Red Hat

No data

ENISA EUVD

Assigner @huntr_ai

Published Mar 20, 2025

Updated Mar 20, 2025

Link EUVD-2025-6871

GitHub

No data