CVE-2024-37032
HIGH EXPLOITED NUCLEIollama < 0.1.34 - Path Traversal via Model Path Digest Validation Bypass
Title source: llmExploitation Summary
CVE-2024-37032 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Bi0x, pankass, itzSh4dowxZ, including a Metasploit module exploits/linux/http/ollama_rce_cve_2024_37032.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-37032, demonstrating a path traversal vulnerability in Ollama via a rogue registry server. The PoC includes a server that serves malicious manifests and a client script to trigger the vulnerability.
Description
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
Exploits (5)
This repository contains a functional exploit for CVE-2024-37032, demonstrating a path traversal vulnerability in Ollama via a rogue registry server. The PoC includes a server that serves malicious manifests and a client script to trigger the vulnerability.
This repository contains a functional exploit for CVE-2024-37032 and CVE-2024-45436, targeting Ollama. The exploit leverages a path traversal vulnerability to upload a malicious shared object file, which is then executed to achieve remote code execution (RCE).
This repository contains a functional proof-of-concept exploit for CVE-2024-37032, targeting the Ollama API. The exploit leverages a path traversal vulnerability to manipulate the `ld.so.preload` file, achieving privilege escalation via a preloaded shared library.
This repository contains a Python-based scanner that checks for vulnerable versions of Ollama by querying the /api/version endpoint and comparing the version against the patched version (0.1.34). It uses multithreading to scan an entire subnet for vulnerable instances.
This Metasploit module exploits CVE-2024-37032, a path traversal vulnerability in Ollama before 0.1.34, by setting up a rogue OCI registry to serve malicious models that write arbitrary files (including a shared library and ld.so.preload) and achieve remote code execution.
Nuclei Templates (1)
ollama
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H