Hi,The Web UI of llama-server accepts a query parameter (?q=...) as an initial user message in a new conversation and auto-submits this message (CSRF). An attacker can trigger an arbitrary initial message through a malicious link. If tool execution is enabled, this can be used for arbitrary code execution, data exfiltration, etc.
By default, the user is asked to allow each tool execution. The user can choose to allow execution only once or to always use execution without confirmation.
Depending on which tools are enabled, the impact can be: * arbitrary shell command execution; * data exfiltration; * etc. The following solution can be used to mitigate this: * disable the Web UI (--no-webui); * do not enabled tools (through --tools); * do not allow tool execution without confirmation (user configuration); * sandbox. Non-working mitigations: * using authentication (API keys) does not help if the API key is configured for the target user.This has been reported as a public issue (#25790 [1]) as requested in the project's security instructions.
Tested on b1003. [1] https://github.com/ggml-org/llama.cpp/issues/25790 [2] https://www.varonis.com/blog/reprompt Regards, Gabriel Corona
OpenPGP_signature.asc
Description: OpenPGP digital signature
