Sagi Tzadik <sagitz@wiz.io>

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

Ollama Model Registry Path Traversal RCE

Metasploit exploitby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2026-02-21ExploitCVE-2024-370321 file

exploit_linux/http/ollama_rce_cve_2024_37032 · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2024-37032, a path traversal vulnerability in Ollama's model pull mechanism, to achieve remote code execution. It starts a rogue OCI registry, serves malicious models that write a shared library and /etc/ld.so.preload via path traversal, then triggers execution via /api/chat.

Backdoor review

No backdoor observed in reviewed code

The supplied Metasploit module source code implements a documented exploit for CVE-2024-37032. It uses a rogue OCI registry to write a payload shared library and /etc/ld.so.preload via path traversal, then triggers execution via the Ollama API. The code contains no concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality. The payload is generated from the Metasploit framework's standard payload mechanism (line 128), and cleanup routines are present (lines 275-276, 311). No backdoor, trojan, or suspicious behavior is observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareollama
Attack typespath_traversalremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises CVE-2024-37032 to achieve remote code execution. It includes all steps: starting a rogue registry, crafting path traversal payloads, writing files, and triggering execution.

modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:89-97modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:6

Requirements

  • Target must be running a vulnerable version of Ollama (before 0.1.34) with the API accessible.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:24-25modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:38-39
  • Attacker must be able to run a rogue OCI registry reachable by the target.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:29-30modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:168-170

Observed behavior

  • Starts a rogue OCI registry server to serve malicious model manifests and blobs.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:168-170
  • Sends a POST request to /api/pull to trigger the target to pull a model containing path traversal sequences in layer digests, writing a malicious shared library and /etc/ld.so.preload.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:251-258modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:235-241
  • Sends a second POST to /api/pull to register a valid trigger model, then uses /api/chat to spawn the llama.cpp runner process, which loads the malicious library via ld.so.preload, executing the payload.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:279-285modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:300-309
  • The generated shared library constructor forks, cleans up /etc/ld.so.preload, and executes the Metasploit payload in the child process.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:127-150
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
Payload withheldThe module uses the standard Metasploit payload generation mechanism to create shellcode, which is then embedded in a shared library. This is normal exploit behavior.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:128
File Cleanup
Payload withheldThe module registers the modified ld.so.preload file for cleanup, indicating an attempt to restore the target system after exploitation.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:275
Model Cleanup
Payload withheldThe module deletes the trigger model after exploitation, which is a cleanup step consistent with the documented exploit flow.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:311
Review boundaries

What the analysis did not establish

  • Analysis is based on source code only; the module was not executed, and its effectiveness or safety is not verified.
  • Metasploit framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
  • Review is limited to the supplied module source code. The behavior of included Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpServer, Msf::Exploit::FileDropper) and the final payload generated by 'payload.encoded' are not expanded or analyzed in this evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.