Thread by @sagitz_

We found a Remote Code Execution (RCE) vulnerability in @Ollama - one of the most popular AI inference projects on GitHub. Here is everything you need to know about #Probllama (CVE-2024-37032) 🧵👇

The issue is a simple Path Traversal vulnerability which can be exploited by pulling a model from a private registry. By specifying a malicious digest field, it is possible to overwrite any file on the system!

We exploited the vulnerability by overwriting /etc/ld.so.preload to load our malicious shared library. This escalated our Arbitrary File Write into a Remote Code Execution 😎

Although a patch for this issue (0.1.34) has been available for over a month, most publicly exposed instances found on Censys are still vulnerable🤯

It's a bad idea to expose your Ollama instance anyway. Attackers can leak models, modify prompts, and use compute resources even without exploiting a vulnerability.

It literally takes one cURL command to inject a malicious prompt into existing Ollama models. It's a feature. Chocolate cakes should not contain dish soap.

This behavior is a common pattern we see in AI tooling: an immature codebase with simple vulnerabilities, no common security mechanism out-of-the-box. Infrastructure security is one of the most challenging aspects of AI security.

For more technical details about this issue, check out our blog:
wiz.io/blog/probllama…