You can deploy this model and start earning money today!

tonydav41/
llamafile-poc-cors-proxy-ssrf-2026-05-12

Name: llamafile-poc-cors-proxy-ssrf-2026-05-12
Availability: InStock

Views

No views yet

Llamafile - Unrestricted SSRF in /cors-proxy

Bug

Llamafile's /cors-proxy endpoint (gated by --webui-mcp-proxy flag) only blocks empty host, basic-auth password, and non-http schemes. AWS IMDS (169.254.169.254), RFC1918 internals (10.x, 172.16-31.x, 192.168.x), and localhost ports are all reachable from the proxy. Chains with the CORS-reflection bug (F-034) for unauthenticated cross-origin SSRF.

Files

repro.sh - one-command reproducer (requires --webui-mcp-proxy flag)

Root cause

llama.cpp/tools/server/server-cors-proxy.h:13-58 - filter only checks empty-host / basic-auth-pw / non-http. No internal-IP block, no AWS metadata block.

Affected version

llamafile-0.10.1-thin (latest as of 2026-05-12).

Severity

CVSS 3.1 7.5 HIGH. Cloud metadata theft -> credential escalation -> downstream RCE. ML-multiplier eligible: model integrity at risk via cloud-credential pivot to model storage.

Reporter

Tony Davis (lendtrain on huntr) - 2026-05-12.

tonydav41/llamafile-poc-cors-proxy-ssrf-2026-05-12